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EVALUATING INTERNAL OPERATION AND IM- 
PLEMENTATION OF THE CHEMICAL FACIL- 
ITY ANTI-TERRORISM STANDARDS PRO- 
GRAM (CFATS) BY THE DEPARTMENT OF 
HOMELAND SECURITY 


FRIDAY, FEBRUARY 3, 2012 

House of Representatives, 

Subcommittee on Environment and the Economy, 

Committee on Energy and Commerce, 

Washington, DC. 

The subcommittee met, pursuant to call, at 9:33 a.m., in room 
2123 of the Rayburn House Office Building, Hon. John Shimkus 
(chairman of the subcommittee) presiding. 

Members present: Representatives Shimkus, Murphy, Pitts, 
Bass, Latta, Harper, Cassidy, Gardner, Barton, Walden, Green, 
Butterfield, Barrow, Pallone, Capps, Dingell, Waxman, and Mar- 
key. 

Staff present: Charlotte Baker, Press Secretary; Anita Bradley, 
Senior Policy Advisor to Chairman Emeritus; Jerry Couri, Senior 
Environmental Policy Advisor; Andy Duberstein, Assistant Press 
Secretary; Dave McCarthy, Chief Counsel, Environment and the 
Economy; Andrew Powaleny, Assistant Press Secretary; Chris 
Sarley, Policy Coordinator, Environment and the Economy; Peter 
Spencer, Professional Staff Member, Oversight; Alex Yergin, Legis- 
lative Clerk; Jacqueline Cohen, Democratic Counsel; Greg Dotson, 
Democratic Energy and Environment Staff Director; and Caitlin 
Haberman, Democratic Policy Analyst. 

Mr. Shimkus. The subcommittee will now come to order. We 
would like to welcome our panel, and I would like to begin with an 
opening statement. 

OPENING STATEMENT OF HON. JOHN SHIMKUS, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

In my time serving in Congress, I have learned, as oftentimes is 
the case, that the initial problem isn’t as big a deal to people as 
a poor explanation of a problem can be. Further, cover-ups are the 
best hope of people who know they are in the wrong and the worst 
move for those who get found out. People who try to hide problems 
or minimize their existence usually face a swifter and more fero- 
cious corrective response from Congress and the public than if they 
had simply come clean. 

It is with great surprise and disappointment that I read the in- 
ternal memorandum about the operation of the division imple- 
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menting the Chemical Facility Anti-Terrorism Standards Act 
(CFATS) and its program at the Department of Homeland Security. 

I, for one, have historically been a strong supporter of this pro- 
gram. I believe the statute is sound and the regulations reasonable. 
In fact, the Anderson Memo calls for only one legislative change: 
long-term extension of the program. 

The CFATS program was not meant to be another EPA-style pro- 
gram designed to fine people or a bureaucratic back door to over- 
regulate chemicals. CFATS was meant to be a collaborative effort 
to secure “high risk” facilities with facility-appropriate measures 
based upon the risks presented. Congressional intent was that co- 
operation would get facilities into compliance; we did not intend to 
increase Federal revenues through enforcement actions. I hope 
DHS is not looking to abandon our original intent. 

Last March, I acknowledged CFATS was a work in progress, but 
I felt security was being enhanced and significant public and pri- 
vate investments were being made to implement the program. I 
still believe security at facilities with chemicals is much better 
today than before Congress gave DHS this first ever regulatory au- 
thority. Unfortunately, my confidence in DHS and the substantial 
amount Congress has given to it is not nearly as strong. 

Someone compared CFATS to an unmanned police car positioned 
at the side of the highway. It wards off speeders, but not much 
else. We need to be reassured that DHS’s CFATS program has a 
plan and intends to focus solely on correcting its internal problems, 
implementing the CFATS program as drafted in law, and not sug- 
gesting the CFATS program should take on any other additional 
responsibilities. I mean, they better first do the responsibilities de- 
signed under law than to take on additional ones, such as drinking 
water or 1ST issues. 

CFATS is an appropriate component of this subcommittee’s juris- 
diction, and the days of matador oversight of this program are over. 
I urge all members of this committee to join me in that effort. 

As a fellow U.S. military officer, I have tremendous respect for 
Under Secretary Beers’ service to this country. That said, he and 
I have been taught that there are only three acceptable responses 
when questioned by an officer: “yes, sir;” “no, sir;” and “no excuse, 
sir;” or “sir, I don’t understand.” Four. I expect no less than that 
today. 

I want to welcome Under Secretary Beers and Deputy Director 
Wulf, who along with Director Penny Anderson showed great cour- 
age with the frankness of the internal memo. Mr. Wulf, both of you 
should know that the committee takes very seriously any evidence 
of undue pressure, influence, intimidation or retaliation whatso- 
ever, because of your testimony today while we continue to inves- 
tigate these important issues. In other words, we really do appre- 
ciate this internal memo. I think it has been very, very helpful and 
we want to ensure those who came forward are not penalized for 
that. Please let my committee staff know right away if you have 
any concerns. Retaliation and intimidation of Congressional wit- 
nesses is illegal and will not be tolerated. 

Mr. Beers, I trust you will ensure that you are in agreement with 
me that no retaliation should be tolerated, and we will hold you 
and any other White House officials accountable to that. 
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Opening Statement Chairman John Shimkus 
Evaluating Internal Operation and Implementation of the Chemical Facility Anti- 
Terrorism Standards program (CFATS) by the Department of Homeland Security 

February 3, 2012 

In my time serving in Congress, I have learned it is often times the case that the initial 
problem isn’t as big a deal to people as a poor explanation of a problem can be. Further, cover 
ups are the best hope of people who know they are in the wrong and the worst move for those 
who get found out. People who try to hide problems or minimize their existence usually face a 
swifter and more ferocious corrective response from Congress and the public than had they 
simply come clean. 

It is with great surprise and disappointment that I read the internal memorandum about 
the operation of the division implementing the Chemical Facility Anti-Terrorism Standards Act 
(CFATS) and its program at the Department of Homeland Security. 

I, for one, have historically been a strong supporter of this program. 1 believe the statute 
is sound and the regulations reasonable - in fact, the Anderson Memo calls for only one 
legislative change: long-term extension of the program. 

The CFATS program was not meant to be another EPA-style program designed to fine 
people or a bureaucratic back door to over regulate chemicals. CFATS was meant to be a 
collaborative effort to secure “high risk” facilities with facility appropriate measures based upon 
the risks presented. 

Congressional intent was that cooperation would get facilities into compliance, we did 
not intend to increase Federal revenues through enforcement actions. I hope DHS is not looking 
to abandon our original intent. 

Last March, 1 acknowledged CFATS was a work in progress, but 1 felt security was being 
enhanced and significant public and private investments were being made to implement the 
program. I still believe security at facilities with chemicals is much better today than before 
Congress gave DHS this first ever regulatory authority. Unfortunately, my confidence in DHS 
and the substantial amounts Congress has given to it is not nearly as strong. 

Someone compared CFATS to the unmanned police car positioned at the side of the 
highway - it wards off speeders, but not much else. 

We need to be reassured that DHS’s CFATS program has a plan and intends to focus 
solely on correcting its internal problems, implementing the CFATS program as drafted in law, 
and not suggesting the CFATS program should take on any additional responsibilities - whether 
that includes 1ST or taking drinking water security oversight away from EPA. 

CFATS is an important component of this Subcommittee’s jurisdiction, and the days of 
matador oversight of this program are over. I urge all members of this Committee to join me in 
that effort. 
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As a fellow U.S. military officer, I have tremendous respect for Undersecretary Beers' 
service to this country. That said, he and 1 have been taught that there are only three acceptable 
responses when questioned by an officer: “yes, sir;” “no, sir;” and “no excuse, sir.” I expect no 
less than that today. 

I want to welcome Undersecretary Beers and Deputy Director Wulf, who along with 
Director Penny Anderson showed great courage with the frankness of their memo. 

Mr. Wulf, both of you should know that the Committee takes very seriously any evidence 
of undue pressure, influence, intimidation or retaliation whatsoever, because of your testimony 
today while we continue to investigate these important issues. 

Please let my Committee Staff know right away if you have any concerns. Retaliation 
and intimidation of Congressional witnesses is illegal and will not be tolerated. 

Mr. Beers, I trust you will ensure that you are in agreement with me that no retaliation 
should be tolerated, and we will hold you and any other White House officials accountable. 
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Mr. Shimkus. With that, I now yield to the distinguished ranking 
member from Texas, Mr. Green, for 5 minutes for the purpose of 
offering his opening statement. 

OPENING STATEMENT OF HON. GENE GREEN, A 
REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. Green. Thank you, Mr. Chairman, for holding the hearing 
today. 

Under Secretary Beers requested an internal memo on the status 
of the CFATS program and recommendations for improvement in 
the summer of 2011. This memo was delivered to Mr. Beers in No- 
vember of 2011, and it leaked to the media and detailed in a story 
on December the 23rd, 2011. I must say, when I read the internal 
memo, I was surprised and dismayed by the level of dysfunction 
and the lack of progress within the CFATS program. I am also 
amazed that during this time, the subcommittee discussed CFATS 
program this year during our work on H.R. 908, the Full Invitation 
of the Chemical Facility Anti-Terrorism Standards Act. We were 
simply unaware of the severity of the situation within DF1S and the 
CFATS program. The portion of the internal memo as related to 
challenges to implementing these priorities — I won’t go into all the 
details, but it seems to me the root of the problem lies with the fact 
that DHS has hired people that are unqualified for their positions 
and was prohibited from hiring appropriate and qualified individ- 
uals, and they had no training program to help those folks who 
were unqualified. These inappropriate hires, along with a lack of 
proper training of the employees, has forced DHS to instead of re- 
assigning inappropriate employees, rely on contractors to do work 
that should be done by the Agency. 

The internal memo outlines several priorities of the program, in- 
cluding the process for the review of the site’s security plans. Un- 
fortunately, at the time of the memo, DHS had received 4,200 site 
security plans and not a single plan was approved. 

I know that DHS is working to clear up all the Tier 1 facilities, 
but it has been 6 years since the program was enacted and we 
haven’t even cleared the low level facilities. They decide how to 
conduct compliance inspections and preparing staff to do the in- 
spections. To date, DHS has conducted not a single compliance in- 
spection. Not that any of my industries that I represent along the 
Houston Ship channel are looking for an inspector to come knock- 
ing on the door, but they are — they have been working to comply 
and they have made substantial private investment. In some cases, 
we actually were able to see grants through DHS for Homeland Se- 
curity protection and our plant protection. 

But I must say that this proposal reinforces problems identified 
in the internal memo, which mostly revolve around the fact that 
DHS is constantly making things more complicated than they need 
to be, and not relying on existing systems, such as the TWIC card, 
to work. What I am speaking about is developing the personnel 
assurity programs. DHS transmitted a new personnel assurity pro- 
gram to OMB, and I have some concerns about this problem — this 
proposal, and will discuss that later. One, because at earlier hear- 
ings in this subcommittee, I felt like I had some assurances that 
the TWIC card would be used as a standard ID for someone work- 
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ing whether it be in waterside or land-based industry under 
CFATS. My concern is additional personal security programs will 
make the duplication of the CFATS. So that is one thing our com- 
mittee needs to look at. 

Last year at the subcommittee hearing, I asked Under Secretary 
Beers if the Department intended to integrate TWIC into the per- 
sonnel assurity program and I received a positive response, and 
yet, the proposal does not make clear that TWIC is an acceptable 
background check. Quite frankly, now is not the time for DHS to 
go reinventing the wheel when implementing the personnel 
assurity program. The memo also includes the Agency’s planned re- 
sponse, including a plan of action for 85 items. 

I look forward to hearing from the witnesses today to confirm, 
but I believe several of the action items haven’t initiated or com- 
pleted. To say the least, I am disheartened by the lack of progress 
in the CFATS program, which seems to stem directly from lack of 
appropriately assigned and trained employees and serious lack of 
moral in the program, which seems to stem from the fact that no 
one constantly knows if the program will be reauthorized by Con- 
gress. Chemical facility security is surely important to the protec- 
tion of our public health, and particularly in the district I rep- 
resent. I represent the Houston ship channel, which is the heart of 
the petrochemical complex that stretches from the Texas Gulf 
Coast and produces more products essential to modern life. It is 
also the largest petrochemical complex in the country. I can’t stress 
how important the success of CFATS is to my constituents who are 
the employees and live in the communities that surround these fa- 
cilities. They deserve the best security standards possible to pre- 
vent the act of terrorism on U.S. soil. 

Our role today is to listen to our witnesses and get a better un- 
derstanding of the problem, and see how Congress can assist. The 
Agency recommends several legislative fixes, and I am hoping we 
have — we on the committee can work together and find a com- 
promise on how to assist DHS, after hearing their suggestions and 
hearing from our stakeholders. The program is too important to our 
national security to be this much in distress. 

Mr. Chairman, thank you for the time and I yield back. 

Mr. Shimkus. The gentleman yields back his time. 

The chair now looks to the — to my colleagues on the right, if any- 
one would like time for an opening statement. Hearing none, the 
chair would like to recognize the ranking member of the full com- 
mittee, Mr. Waxman, for 5 minutes. 

OPENING STATEMENT OF HON. HENRY A. WAXMAN, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF CALI- 
FORNIA 

Mr. Waxman. Thank you, Mr. Chairman, for calling on me, and 
more importantly, for holding this hearing to examine the imple- 
mentation by the Department of Homeland Security of the Chem- 
ical Facility Anti-Terrorism program, or Standards. The letters 
have been made into a shorthand called CFATS. This program is 
intended to address the threat of terrorism to the Nation’s chemical 
facilities. We will hear testimony about its successes. But we are 
also going to hear about the program’s many challenges. 
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The CFATS program was established in 2006. Now, almost 6 
years later, it is clear that implementation has stumbled because 
of serious challenges and limitations in the program. 

Under Secretary Beers will testify about a detailed report that he 
received in November of last year. This report takes the form of a 
memorandum, and DHS has also provided it to the committee. It 
paints a stark picture of this program. According to this memo- 
randum, the program has been plagued by personnel issues, budget 
issues, and statutory limitations. 

The challenges described in the memo are serious, and they must 
be addressed. 

Department of Homeland Security has a plan to address the 
identified problems, and that plan deserves our careful scrutiny. 
This is a crucially important effort and we must get it right. 

In some ways, the odds have always been stacked against this 
program. This program was created by a provision not authorized 
by this committee, but a rider on an appropriations bill. The pro- 
gram was not established with carefully crafted legislation that de- 
fined its mission and forged a vision for its implementation. 

It did not have adequate enforcement authorities, enforceable 
deadlines, or clear procedures for approving or disapproving site se- 
curity plans. It never even had an authorization. 

And in some ways, it is fortunate that we have learned of these 
problems when we have, because this committee can now return to 
this issue and do the hard work of understanding where the prob- 
lems are and determining how to fix them. 

It is stunning to realize that this committee of Congress, which 
has jurisdiction over this issue, reported legislation that simply 
rubber-stamped the current program for 7 additional years. We 
didn’t really know how the program was working. We didn’t give 
it any guidance. We didn’t do our job, and that legislation needs 
to be revisited in light of this new information. 

I look forward to the testimony of Under Secretary Beers and 
learning more about the Department’s efforts to get this program 
on track. The Department can take constructive actions, but it can 
only do so much. They cannot address shortcomings in the under- 
lying statute. That task falls to us as the committee of jurisdiction 
and the committee that should have been involved in crafting the 
original provision. That is a responsibility we must take very seri- 
ously. 

I hope today’s hearing will be part of an ongoing effort by this 
committee to address these serious challenges facing our chemical 
facility security program. This is an important issue. It deserves 
our attention. 

In the last Congress, when I was chairman of the committee, we 
were working on a bipartisan basis. We brought in all the stake- 
holders to craft legislation to authorize the program. It was a major 
undertaking. We brought in industry, we brought in labor, we 
brought in everybody else that had a concern about this issue. We 
were consulting everyone throughout the process. That is the type 
of undertaking we should begin anew, because what we saw this 
last year was not a furtherance of examination of the program, but 
simply saying oh, it is already in effect for 6 years. We will con- 
tinue it down the road and we hope it will do a good job. We have 
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got more work to do than just sending our best wishes for the long 
period of authorization without doing a thorough examination to 
figure out how we can make this program work the way we in- 
tended it to and the way it must to protect the security of the 
American people. 

Thank you, Mr. Chairman. I yield back the time. 

Mr. Shimkus. And I thank you, Mr. Waxman, for your state- 
ment. 

I would like to yield, with the permission of the committee, to 
Mr. Barton for 5 minutes, but before I do, I would just like to say, 
based upon my opening statement, I think Mr. Waxman’s response 
was pretty much what I said. When problems are hid, you are 
going to face a swifter and more ferocious corrective response by 
Congress, and that is really part of that concern. I would also say, 
we did have a hearing prior to the markup of that bill where De- 
partment of Homeland Security said things were going well. Obvi- 
ously — and industry and obviously, that is not the case, either. 

So with that, I would like to yield 5 minutes to the chairman 
emeritus, Mr. Barton. 

OPENING STATEMENT OF HON. JOE BARTON, A 
REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. Barton. Thank you, Mr. Chairman. I am not sure I will take 
that time, and if I don’t, I am happy to yield it to anybody else that 
you wish it to be yielded to. I do appreciate you for holding this 
hearing, you and Mr. Green, on the Chemical Facility Anti-Ter- 
rorism Standard Program, which has the acronym CFATS. 

Back in March of last year, we discussed the concerns and dis- 
satisfaction that the program had not met its goals. This program 
was set up to serve and protect the companies and the general pub- 
lic against the potential threat of terrorist activity. I was chairman 
of this committee back in the 109th Congress, and one of the au- 
thors of the Chemical Facility Anti-Terrorism Standard Act that 
was included as Section 550 of the Department of Homeland Secu- 
rity’s appropriation act for 2007. 

The intent was very clear. It was for the safety of the Nation’s 
businesses and its citizens against the threat of terrorism in these 
types of facilities. I understand that the program has got many fac- 
ets and that the orchestration of a thorough implementation plan 
at an expedited pace could have challenges. What I don’t seem to 
understand is how the Under Secretary could be so unaware for so 
long of so many of the internal problems. Why have employees 
been hired in managerial positions who don’t have the skill set to 
fulfill their jobs? Why has it taken 3 years to start addressing the 
internal managerial staff training and implementation problems? 
The industry has invested billions of dollars to upgrade security to 
meet the CFATS requirements. This is beyond disappointing. You 
have totally mismanaged this program, Mr. Under Secretary. We 
have spent about $90 million a year, and we have no well-devel- 
oped direction and no plan. 

It is my understanding that you have received over 4,200 site se- 
curity plans to date, but not even one has been approved. Now, we 
have our differences on this committee and this subcommittee, and 
there were differences between the Democrats and Republicans 
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when this bill was put into law, but there is nobody, no one, re- 
gardless of political affiliation that says if you receive 4,200 site se- 
curity plans, you don’t even get one approved? Not one? I mean, 
when I read that a couple of days ago, I was just astounded. Your 
own national protection and programs directorate have prevented 
you from hiring personnel with the experience and qualifications to 
review these programs and to conduct the compliance inspection. 
You have allowed the hiring of inappropriate staff and have not 
taken control of your own infrastructure security compliance divi- 
sion to fix this problem, and it has been 3 years. The administra- 
tion of the CFATS program must be fixed immediately to provide 
stability to the program and regulatory assurance to thousands of 
covered facilities, many of whom are members of the Society of 
Chemical Manufacturing and Affiliates Alliance, SOCMA. They 
have invested heavily in security measures over the past 5 years 
to attempt to be in compliance. 

I have to say one good thing. Your office has been open and can- 
did and transparent in providing the internal memoranda for com- 
mittee staff to review. That is one positive checkmark in your col- 
umn. Having said that, everything else is in the negative and ev- 
erything else is black. It is time to get this thing done. If you can’t 
do it, resign. If there are things that need to be fixed, tell us and 
we will try to do it. I think Mr. Waxman’s opening statement was 
very good, as was Mr. Shimkus’s, which I wasn’t here to hear, but 
I did read. 

With that, Mr. Chairman, I have got a minute left if you want 
me to yield it. 

Mr. Shimkus. Let me reclaim that time and look to Chairman 
Emeritus Dingell to see if he would like to use the remainder of 
your time. 

OPENING STATEMENT OF HON. JOHN D. DINGELL, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF MICHI- 
GAN 

Mr. Dingell. Most briefly, Mr. Chairman. Thank you. 

I want to welcome our two witnesses and our panels today, Sec- 
retary Beers and Mr. Wulf, and I want to commend you for having 
this hearing. I want to note that it is being conducted in a bipar- 
tisan fashion, something which merits high praise around this 
place. Having said that, I look forward to the results of the hearing 
today. I would note that I have a number of these facilities in my 
district, and when they let go, as one did not long back, it causes 
lots of excitement and can cause significant numbers of casualties 
and enormous hardships on the communities in which the facility 
might exist. So your labors and your leadership, Mr. Chairman, are 
much appreciated and I look forward to the hearing going forward 
in the spirit in which it has begun, and in the hopes that we will 
be able to see to it that we get these programs of widely differing 
character under different agencies in the point where they are pull- 
ing together and working together to accomplish the great purpose 
of seeing to it that we have safety and security for the country. 

Thank you, Mr. Chairman. 

Mr. Shimkus. Thank you, Mr. Dingell. 
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With that, the chair calls forward today’s witnesses, the Honor- 
able Rand Beers, the Under Secretary of National Protection and 
Programs Directorate at the Department of Homeland Security, 
and Mr. David M. Wulf, who is Deputy Director of Infrastructure 
Security Compliance Division, Office of Infrastructure Protection, 
National Protection and Programs Directorate at the U.S. Depart- 
ment of Homeland Security. 

As you know, the testimony that you are about to give is subject 
to Title 18, Section 1001 of the United States Code. When holding 
an investigative hearing, this committee has the practice of taking 
testimony under oath. Do you have any objection to testifying 
under oath? 

The chair then advises you that under the rules of the House and 
the rules of the committee, you are entitled to be advised by coun- 
sel. Do you desire to be advised by counsel during your testimony 
today? 

In that case, if you would please rise and raise your right hand, 
I will swear you in. 

[Witnesses sworn.] 

Mr. Shimkus. You may now be seated, and it is my under- 
standing that the only opening statement will be given by you, Mr. 
Secretary, and Mr. Wulf is here to answer questions with regard 
to the internal? They are both going to give it, OK. Change in di- 
rection from last night, so Mr. Beers, if you would then — you are 
recognized for 5 minutes to give your opening statement. 

TESTIMONY OF RAND BEERS, UNDER SECRETARY, NATIONAL 

PROTECTION AND PROGRAMS DIRECTORATE, DEPARTMENT 

OF HOMELAND SECURITY; AND DAVID M. WULF, DEPUTY DI- 
RECTOR, INFRASTRUCTURE SECURITY COMPLIANCE DIVI- 
SION, OFFICE OF INFRASTRUCTURE PROTECTION, NA- 
TIONAL PROTECTION AND PROGRAMS DIRECTORATE, DE- 
PARTMENT OF HOMELAND SECURITY 

TESTIMONY OF RAND BEERS 

Mr. Beers. Thank you, Chairman Shimkus and Ranking Mem- 
ber Green, and distinguished members of this committee. I am 
pleased to be here before you today to discuss the Department of 
Homeland Security’s efforts to regulate the security of high-risk 
chemical facilities under the Chemical Facility Anti-Terrorism 
Standards Act. 

As you all are aware, the Department’s current statutory author- 
ity to implement CFATS came about, as mentioned earlier, in Sec- 
tion 550 of the fiscal year 2007 appropriations act, and it has been 
amended recently to extend that authorization until October 4 of 
2012. I believe strongly in the CFATS program, and I welcome the 
opportunity to continue to work with this committee, with the Con- 
gress, and levels of government and the private sector to further 
improve this vital national security program. 

Since the inception of CFATS, we have issued a basic rule, we 
have defined chemicals of interest, we have jointly conducted two 
surveys with industry to define the facilities that have a substan- 
tial enough quantity of chemicals that caused them to be deter- 
mined could be at high risk. After receiving the initial submissions 
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from more than 40,000 facilities that might potentially be under 
the program, we have narrowed that down now to about 4,500 cov- 
ered facilities. And in the process of doing that, more than 1,600 
facilities which would have fallen under the program and 700 fa- 
cilities — 1,600 facilities have totally removed their chemicals of in- 
terest and 700 have reduced them to the point that they are no 
longer under the program. So I think we can say that these actions 
represent some of the successes have happened with respect to this 
program and the adoption of the regulation. So I think we can say 
that there has been a reduction in risk throughout the Nation, and 
that the Nation has correspondingly been made more secure. 

The Department has done much work over the past few years to 
establish and implement this unprecedented program, but as the 
report suggests and as we acknowledge, CFATS still has a number 
of challenges to address. In recognition of this and upon the arrival 
of Penny Anderson and David Wulf, I asked both of them to pro- 
vide for my consideration the views on the successes and challenges 
of the program. Candid, honest assessments and challenges to the 
program. These kinds of assessments are extraordinarily valuable 
tools that we need in order to evaluate progress and to determine 
where improvement is needed. Furthermore, in an unprecedented 
program like CFATS, course corrections are to be expected and on- 
going decisions will need to be made. 

In late November of 2011, a detailed report was hand delivered 
to me. It is important to note that in addition to the referenced 
challenges, the report also proposed for my consideration a charted 
path that will address those challenges. Specifically, the report in- 
cluded an action plan with detailed recommendations for address- 
ing the issues identified, and we have shared those recommenda- 
tions with this committee. Since my receipt of this report, each of 
the nearly 100 items in the action plan have been assigned to a 
member of the program’s senior leadership team and I have al- 
ready seen progress on these issues. For accountability planning 
tracking purposes, the members of the leadership team have been 
asked to provide milestones and a schedule for completion of each 
task assigned to them. The program’s acting chief of staff will mon- 
itor that progress. In addition, program leadership now meets with 
my principal Deputy Under Secretary, Suzanne Spalding, at least 
once a week to provide status updates to this program. 

Mr. Chairman, let me assure you, there will be no retaliation to 
the people who wrote this report who have served me and you and 
this Nation by frankly telling us where we had challenges and 
what we need to do about it, nor will I tolerate any retaliation be- 
tween me and the office director and her deputy. You have my 
pledge on that and I expect to be held accountable to that issue. 

The Department does take its responsibilities for CFATS and the 
Nation’s security seriously, and we are going to move forward both 
quickly and strategically to address the challenges before us. 
Again, we believe that CFATS is making the Nation safer and we 
are dedicated to its success. We will make the necessary course di- 
rections to improve the program to protect the Nation. 

Thank you for holding this important hearing, and I will be 
happy to answer any of your questions. 

[The prepared statement of Mr. Beers follows:] 
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Thank you, Chairman Shimkus, Ranking Member Green, and distinguished Members of the 
Committee. It is a pleasure to appear before you today to discuss the Department of Homeland 
Security's (DHS) efforts to regulate the security of high-risk chemical facilities under the 
Chemical Facility Anti-terrorism Standards (CFATS). 

As you are aware, the Department's current statutory authority to implement CFATS - Section 
550 of the Fiscal Year (FY) 2007 Department of Homeland Security Appropriations Act, as 
amended — was recently extended through October 4, 2012. 1 believe strongly in the CFATS 
program and welcome the opportunity to continue to work with this Committee, Congress, and 
all levels of government and the private sector to further improve this vital national security 
program. 

In the interest of facilitating that collaboration, my testimony today focuses on the current 
program, examples of the program’s success to date, some of the current challenges facing the 
National Protection and Programs Directorate (NPPD) in implementing CFATS, and the actions 
we are taking to address these challenges. Additionally, I will reiterate the principles that we 
believe should guide the program's maturation and continued authorization. 

1 would also like to elaborate on recent reports of challenges faced by this program. At my 
direction, the program’s leadership has outlined their priorities, the challenges they believe the 
program faces, and a proposed path to address those challenges and accomplish the program 
objectives. NPPD remains committed to examining the program and making improvements and 
I look forward to discussing them with you today. 1 assure this Committee that the CFATS 
program is making progress; NPPD, the Directorate with oversight responsibility for the CFATS 
program, is continuously reviewing the program to identify areas for improvement and 
correcting course when necessary to ensure proper implementation; and that CFATS is a 
valuable national security program worth supporting. 

Chemical Facility Security Regulations 

Section 550 of the FY 2007 Department of Homeland Security Appropriations Act directed the 
Department to develop and adopt, within six months, a regulatory framework to address the 
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security of chemical facilities that the Department determines pose high levels of risk. 
Specifically, Section 550(a) of the Act authorized the Department to adopt rules requiring high- 
risk chemical facilities to complete Security Vulnerability Assessments (SVAs), develop Site 
Security Plans (SSPs), and implement protective measures necessary to meet risk-based 
performance standards established by the Department, Consequently, the Department published 
an Interim Final Rule, known as CFATS, oil April 9, 2007. Section 550, however, expressly 
exempts from those rules certain facilities that are regulated under other federal statutes, 
specifically those regulated by the United States Coast Guard pursuant to the Maritime 
Transportation Security Act (MTSA), drinking water and wastewater treatment facilities as 
defined by Section 1401 of the Safe Water Drinking Act and Section 212 of the Federal Water 
Pollution Control Act, and facilities owned or operated by the Departments of Defense or 
Energy, as well as certain facilities subject to regulation by the Nuclear Regulatory Commission 
(NRC). 

The following core principles guided the development of the CFATS regulatory structure: 

1 . Securing high-risk chemical facilities is a comprehensive undertaking that involves a 
national effort , including all levels of government and the private sector. Integrated and 
effective participation by all stakeholders — federal, state, local, tribal and territorial 
government partners as well as the private sector — is essential to securing our critical 
infrastructure, including high-risk chemical facilities. Implementing this program means 
tackling a sophisticated and complex set of issues related to identifying and mitigating 
vulnerabilities and setting security goals. This requires a broad spectrum of input, as the 
regulated facilities bridge multiple industries and critical infrastructure sectors. By 
working closely with members of industry and academia, and partners in the federal 
government, we leveraged vital knowledge and insight to develop the regulation; 

2. Risk-based tiering is used to guide resource allocations. Not all facilities present the 
same level of risk. The greatest level of scrutiny should be focused on those facilities 
that present the highest risk — those that, if attacked, would endanger the greatest number 
of lives; 

3. Reasonable, clear, and calibrated performance standards will lead to enhanced security. 
The CFATS rule includes enforceable risk-based performance standards (RBPS). High- 
risk facilities have the flexibility to develop appropriate site-specific security measures 
that will effectively address risk by meeting these standards. NPPD’s Infrastructure 
Security Compliance Division (ISCD), the Division within NPPD responsible for 
managing CFATS, will analyze all final high-risk facility SSPs to ensure they meet the 
applicable RBPS and will approve those that do. If necessary, ISCD will work with a 
facility to revise and resubmit an acceptable plan; and 

4. Recognition of the progress many companies have already made in improving facility 
security leverages those advancements. Many companies made significant capital 
investments in security following 9/1 1, and even more have done so since the passage of 
the legislation establishing this program. Building on that progress in implementing the 
CFATS program will raise the overall security baseline at high-risk chemical facilities. 

On November 20, 2007, the Department published CFATS’ Appendix A, which lists 322 
chemicals of interest — including common industrial chemicals such as chlorine, propane, and 
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anhydrous ammonia — as well as specialty chemicals, such as arsine and phosphorus trichloride. 
The Department included chemicals based on the potential consequences associated with one or 
more of the following three security issues: 

1 . Release - Toxic, flammable, or explosive chemicals that have the potential to create 
significant adverse consequences for human life or health if intentionally released or 
detonated; 

2. Theft/Diversion - Chemicals that have the potential, if stolen or diverted, to be used as or 
converted into weapons that could cause significant adverse consequences for human life 
or health; and 

3. Sabotage/Contamination - Chemicals that, if mixed with other readily available 
materials, have the potential to create significant adverse consequences for human life or 
health. 

The Department also established a Screening Threshold Quantity for each chemical of interest 
based on its potential to create significant adverse consequences to human life or health in one or 
more of these ways. 

implementation of the CFATS regulation requires the Department to identify which facilities it 
considers high-risk. In support of this, ISCD developed the Chemical Security Assessment Tool 
(CSAT) to help it identify potentially high-risk facilities and to provide methodologies those 
facilities can use to conduct SVAs and to develop SSPs. CSAT is a suite of online applications 
designed to facilitate compliance with the program; it includes user registration, the initial 
consequence-based screening tool (Top-Screen), an SVA tool, and an SSP template. 

Through the Top-Screen process, iSCD initially identifies high-risk facilities, which the 
Department then assigns to one of four preliminary risk-based tiers, with Tier 1 representing the 
highest level of potential risk. Tiered facilities must then complete SVAs and submit them to the 
Department for approval, although preliminary Tier 4 facilities may submit an Alternative 
Security Program (ASP) in lieu of an SVA. Each SVA is carefully reviewed for its description of 
how chemicals are managed and for physical, cyber, and chemical security risks. 

After completing its review of a facility's SVA, ISCD makes a final determination as to whether 
the facility is high-risk and, if so, assigns the facility a final risk-based tier. Each final high-risk 
facility is then required to develop for ISCD approval an SSP or, if it so chooses, an ASP, that 
addresses its identified vulnerabilities and security issues and satisfies the applicable RBPS. 
ISCD's final determinations as to which facilities are high-risk, and as to their appropriate tier 
levels, are based on each facility's individual consequentiality and vulnerability as determined by 
its Top-Screen, SVA, and any other available information. The higher the facility's risk-based 
tier, the more robust the security measures it will be expected to adopt in its SSP. Risk tier will 
also be a factor in determining the frequency of inspections. 

The SSP is a critical element of the Department's efforts to secure the nation's high-risk chemical 
facilities; it enables final high-risk facilities to document their individual security strategies for 
meeting the applicable RBPS. The RBPS cover the fundamentals of security, such as restricting 
the area perimeter, securing site assets, screening and controlling access, cybersecurity, training. 
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and response. Each high-risk facility's security strategy and SSP will be unique, as they depend 
on the facility's risk level, security issues, characteristics, and other facility-specific factors. In 
fact, under Section 550, the Department cannot mandate a specific security measure to approve 
the SSP. 

Therefore, the CSAT SSP tool collects information on how each facility will meet the applicable 
RBPS. The SSP tool is designed to take into account the complicated nature of chemical facility 
security and allows facilities to describe both facility-wide and asset-specific security measures. 
NPPD understands that the private sector generally, and CFATS-affected industries in particular, 
are dynamic. The SSP tool allows facilities to involve their subject-matter experts from across 
the facility, company, and corporation, as appropriate, in completing the SSP and submitting a 
combination of existing and planned security measures to satisfy the RBPS. NPPD expects that 
most SSPs will comprise both existing and planned security measures. Through a review of the 
SSP, in conjunction with an on-site inspection, ISCD determines whether a facility has met the 
requisite level of performance given its risk profile and thus whether its SSP should be approved. 

For additional context, I would like to provide you with an example of how some facilities 
approach the development and submission of their SSPs: in the case of a Tier 1 facility with a 
release hazard security issue, the facility is required to restrict the area perimeter appropriately, 
which may include preventing breach by a wheeled vehicle. To meet this standard, the facility is 
able to propose numerous security measures, such as by cables anchored in concrete blocks 
along with movable bollards at all active gates or by perimeter landscaping (e.g., large boulders, 
steep berms, streams, or other obstacles) that would thwart vehicle entry. The Department will 
approve the security measure as long as ISCD determines it to be sufficient to address the 
applicable performance standard. 

In May 2009, DHS issued Risk-Based Performance Standards Guidance to assist high-risk 
chemical facilities in determining appropriate protective measures and practices to satisfy the 
RBPS. It is designed to help facilities comply with CFATS by providing detailed descriptions of 
the 18 RBPS as well as examples of various security measures and practices that could enable 
facilities to achieve the appropriate level of performance for the RBPS at each tier level. The 
Guidance also reflects public and private sector dialogue on the RBPS and industrial security, 
including public comments on the draft guidance document. High-risk facilities are free to make 
use of whichever security programs or processes they choose — whether or not in the Guidance — 
provided that they achieve the requisite level of performance under the CFATS RBPS. 

Implementation Status 

To date, ISCD has reviewed more than 40,000 Top-Screens submitted by chemical facilities. 
Since June 2008, ISCD has notified more than 7,000 facilities that they have been initially 
designated as high-risk and are thus required to submit SVAs; and ISCD has completed our 
review of approximately 6,500 submitted SVAs. (Note, not all facilities initially designated as 
high-risk ultimately submit SVAs or ASPs, as some choose to make material modifications to 
their chemical holdings, or make other changes, prior to the SVA due date that result in the 
facility no longer being considered high-risk.) In May 2009, ISCD began notifying facilities of 
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their final high-risk determinations, risk-based tiering assignments, and the requirement to 
complete and submit an SSP or ASP. 

In May 2009, ISCD issued 141 final tier determination letters to the highest risk (Tier 1) 
facilities, confirming their high-risk status and initiating the 1 20-day time frame for submitting 
an SSP. After issuing this initial set of final tier determinations, ISCD periodically issued 
notifications to additional facilities of their final high-risk status. To date, more than 4,100 
additional facilities have received final high-risk determinations and tier assignments, and 
several hundred that were preliminarily-tiered by ISCD were informed that they are no longer 
considered high-risk. 

As of January 6, 2012, CFATS covers 4,458 high-risk facilities nationwide; of these 4,458 
facilities, 3,727 have received final high-risk determinations and due dates for submission of an 
SSP or ASP. ISCD continues to issue final tier notifications to facilities across all four risk tiers 
as we make additional final tier determinations. 

It should be noted that since CFATS’ inception, more than 1,600 facilities completely removed 
their chemicals of interest, and more than 700 other facilities have reduced their holdings of 
chemicals of interest to levels resulting in the facilities no longer being considered high-risk. 
These actions, many of which NPPD believes were the result of choices made by facilities after 
Congressional passage of Section 550 and the adoption of the CFATS regulation, have helped 
reduce the number of high-risk chemical facilities located throughout the nation, and have 
correspondingly made the nation more secure. This is just one way in which Congress’ passage 
of Section 550 to authorize the CFATS program is already helping to make our citizens safer and 
our nation more secure. 

• Prior to approving an SSP, ISCD must first authorize the SSP. In February 2010, ISCD 
began conducting pre-authorization inspections of final-tiered facilities, starting with the 
Tier 1 facilities, and has completed approximately 180 such pre-authorization inspections 
to date. ISCD used these initial inspections to help gain a comprehensive understanding 
of the processes, risks, vulnerabilities, response capabilities, security measures and 
practices, and other factors at a covered facility that affect security risk and to help 
facilities more fully develop and explain the security measures in their SSPs. After ISCD 
issues a Letter of Authorization for a facility's SSP, ISCD conducts a comprehensive and 
detailed authorization inspection before making a final determination as to whether the 
facility's SSP satisfies all applicable RBPS. To date, ISCD has authorized 53 SSPs and 
conducted 10 authorization inspections. Facilities that successfully pass inspection and 
that DHS determines have satisfied the RBPS will then be issued Letters of Approval for 
their SSPs. They must fully implement their approved SSPs to be considered CFATS- 
compliant. ISCD plans to issue the first Letters of Approval in 2012 and is currently 
conducting its due diligence to ensure that the existing or planned security measures at 
any facility that will receive a Letter of Approval will, in fact, meet the appropriate risk- 
based performance standards. 

• Under CFATS, Administrative Orders are the first formal step toward enforcement. An 
Administrative Order does not impose a penalty or fine but directs the facility to take 
specific action to comply with CFATS — for example, to complete an overdue SSP within 
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a specified timeframe, if the facility does not comply with the Administrative Order, the 
Department may issue an Order Assessing Civil Penalty of up to $25,000 each day the 
violation continues and/or an Order to Cease Operations. In June 2010, ISCD issued its 
first Administrative Orders to 1 8 chemical facilities for failure to submit an SSP. During 
the remainder of the year ISCD issued an additional 48 Administrative Orders to 
chemical facilities that had failed to submit their SSPs in a timely manner under CFATS. 
We are pleased to report that all 66 facilities complied with the Administrative Orders 
issued. As CFATS implementation progresses, we expect to continue to exercise our 
enforcement authority to ensure CFATS compliance. 

Outreach Efforts 

Since the release of CFATS in April 2007, ISCD has taken significant steps to publicize the rule 
and ensure that the regulated community and our security partners are aware of its requirements. 
As part of this outreach program, ISCD has regularly updated impacted sectors through their 
Sector Coordinating Councils and the Government Coordinating Councils of industries most 
impacted by CFATS, including the Chemical, Oil and Natural Gas, and Food and Agriculture 
Sectors. ISCD has also solicited feedback from our public and private sector partners and, where 
appropriate, have reflected that feedback in implementation activities. As the program continues 
to mature, on average, ISCD staff participate in more than 250 CFATS-specific outreach 
engagements annually, not including formal coordination activities with individual facilities such 
as pre-authorization inspections and Compliance Assistance Visits. 

To date, ISCD inspectors have conducted nearly 900 Compliance Assistance Visits and have 
held more than 3,000 informal introductory meetings with owners and/or operators of CFATS- 
regulated facilities. ISCD staff have presented at hundreds of security and chemical industry 
conferences; participated in a variety of other meetings of relevant security partners; established 
a Help Desk for CFATS questions that receives between 40 and 80 calls daily; put in place a 
CFATS tip-line for anonymous chemical security reporting; and developed and regularly 
updated a highly regarded Chemical Security website f www.DHS.gov/cliemicalsectiritvT which 
includes a searchable Knowledge Center. ISCD has also offered regular SSP training webinars 
to assist high-risk facilities to complete their SSPs. 

In addition, ISCD continues to focus on fostering solid working relationships with state and local 
officials as well as first responders in jurisdictions with high-risk facilities. To meet the risk- 
based performance standards under CFATS, facilities need to cultivate and maintain effective 
working relationships — including a clear understanding of roles and responsibilities — with local 
officials who aid in preventing, mitigating and responding to potential attacks. To facilitate these 
relationships, ISCD inspectors have been actively working with facilities and officials in their 
areas of operation, and they have participated in more than 2,000 meetings with federal, state, 
and local partners, including more than 100 Local Emergency Planning Committee meetings. 
Such meetings afford ISCD inspectors with an opportunity to provide our federal, state, and local 
security partners with a better understanding of CFATS requirements and allow our inspectors to 
gain insight into the activities of federal, state, and local partners operating within their 
jurisdictions. 


6 



19 


Other efforts to ensure state and local awareness of and involvement in CFATS include the joint 
development with the State, Local, Tribal, and Territorial Government Coordinating Council and 
sharing of outreach materials specifically tailored to the emergency response community, which 
summarize CFATS programs and processes for local emergency responders; annual 
collaboration with the State of New Jersey’s Office of Homeland Security and Preparedness and 
participation in several CFATS-based workshops hosted by the state that have brought together 
facility owners/operators, site security personnel, emergency responders, and other state-based 
stakeholders; and participation in two successful CFATS workshops hosted by the State of 
Michigan in Detroit and Midland, Michigan. Moving forward, ISCD hopes to continue and 
expand our collaborative efforts with our state partners on CFATS-based workshops. 
Additionally, in May 2010, ISCD launched a web-based information-sharing portal called 
"CFATS-Share,” This tool provides selected Federal, State, and Local stakeholders, such as 
interested state Homeland Security Advisors and their designees, DHS Protective Security 
Advisors, the National Infrastructure Coordinating Center, the DHS Chemical Sector-Specific 
Agency, as w'ell as members of the State, Local, Tribal and Territorial Government Coordinating 
Council, access to key details on CFATS facility information as needed. 

ISCD also continues to collaborate within DHS and with other federal agencies in the area of 
chemical security, including routine engagement among the NPPD’s subcomponents and with 
the USCG, the Transportation Security Administration, the Department of Justice's FBI and 
Bureau of Alcohol, Tobacco, Firearms and Explosives, the NRC, and the EPA. An example of 
this coordination includes the establishment of a joint 1SCD/USCG CFATS-MTSA Working 
Group to evaluate and, where appropriate, implement methods to harmonize the CFATS and 
MTSA regulations. Similarly, NPPD has been working closely with the EPA to begin evaluating 
how the CFATS approach could be used for water and wastewater treatment facilities, should the 
water and wastewater treatment facility exemption he revised by Congress in future versions of 
chemical facility security or water facility security legislation. 

Internally, we are continuing to build ISCD. We have hired, or are in the process of on- 
hoarding, more than 206 people, and we are continuing to hire to meet our staffing goal of 253 
positions this fiscal year. These numbers include our field inspector cadre, where we have filled 
102 of 108 field inspector positions and 14 of 14 field leadership positions. 

Identified Challenges and Next Steps 

The Department, NPPD, and ISCD have done much work over the past few years to establish 
and implement this unprecedented regulatory program, but CFATS still has challenges to 
address. In recognition of this, upon the arrival of ISCD’s new Director and Deputy Director, 1 
asked them to provide for my consideration their views on the successes and challenges of the 
CFATS program. Candid, honest assessments and critiques are valuable tools in evaluating 
progress and determining where improvement is needed. Furthermore, in a nascent and 
unprecedented program like CFATS, course corrections are to be expected and ongoing 
decisions will need to be made. 

In late November 201 1 , a detailed report was hand-delivered to me. It is important to note that, in 
addition to the referenced challenges, the report also proposed for my consideration a charted 
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path to addressing the challenges. Specifically, the report included an Action Plan with detailed 
recommended steps for addressing the issues identified, and we have shared those with this 
Committee. Since my receipt of the report, each of the nearly 100 action items contained in the 
Action Plan has been assigned to a member of ISCD's senior leadership team for action, and I 
have already seen progress on many of these items. For accountability, planning, and tracking 
purposes, the members of that leadership team have been asked to provide milestones and a 
schedule for the completion of each task assigned to them, and the Acting ISCD Chief of Staff 
will monitor progress. In addition, ISCD leadership meets with my Principal Deputy Under 
Secretary at least once a week to provide status updates on the action items. 

The speed with which the program was stood up resulted in some decisions that, at the time, 
seemed appropriate. For example, at the program’s outset, certain roles and responsibilities were 
envisioned for the program staff that, in the end, did not apply. This resulted in the hiring of 
some employees whose skills did not match their ultimate job responsibilities and the purchase 
of some equipment that in hindsight appear to be unnecessary for chemical inspectors. 
Additionally, we envisioned a greater number of field offices than we eventually decided to 
employ. These challenges resulted directly from an accelerated stand-up of the program — and 
while we regret that they occurred, we consider them valuable lessons learned. 

1 would like to point out to the Committee that NPPD has made progress in addressing some of 
the other challenges in the report. One identified challenge regards the ability of ISCD to 
complete SSP reviews in a consistent, reasonable, and timely fashion. To help overcome past 
difficulties in meeting this challenge, ISCD is utilizing an interim SSP review process that is 
allowing the Department to review Tier 1 facility SSPs in a more effective and timely manner. 
Using this interim approach, over the past few months, ISCD has been able to more than 
quadruple the number of authorized SSPs, and 1 am pleased to report that as of January 23, 2012, 
53 Tier I SSPs have been authorized to date. ISCD expects to complete its review of all Tier .1 
SSPs and to notify the facilities of ISCD’s decisions on those SSPs within the coming months. 
ISCD also expects to begin issuing authorizations to Tier 2 facilities during FY12. While this 
interim review process is under way, ISCD is also working on an even more efficient long-term 
approach to SSP review for facilities in Tiers 2, 3, and 4. This long-term approach will 
incorporate lessons learned. 

A second challenge identified in the report concerns organizational culture and morale. Based in 
part on internal staff surveys and personal observation, ISCD leadership believes that improved 
internal communication, stronger programmatic leadership, consistent levels of accountability, 
and a clearly articulated shared vision and values will significantly improve morale throughout 
ISCD. The Action Plan contains numerous planned or proposed actions designed to achieve this 
goal, many of which already are being implemented. 

For instance, ISCD employees now contribute to, and receive a monthly ISCD newsletter and 
weekly updates on ISCD events in an effort to improve internal communications; numerous 
ISCD Director-led town halls and open-door sessions have been held with employees in D.C. 
and throughout the country; vacancy announcements that will be used to hire a permanent 
leadership team to support the new Director and Deputy Director are going through the 
Departmental human capital process; more thorough supervisory training and guidance on 
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performance monitoring is being identified and will be provided to ail Divisional supervisors; 
and a cross-Divisional working group was established to update or develop a Division mission 
statement, vision statement, and statement of core values, which will be shared and consistently 
reinforced with all 1SCD staff. Through these and other activities, I believe that Division-wide 
morale is improving, which ultimately will pay dividends not only in improved staff retention, 
but also in improved staff performance. In addition, ISCD leadership has worked with, and will 
continue to work with, the CFATS inspector cadre’s union to develop and implement solutions 
to address these challenges. 

In working on implementing action items and identifying the best solutions for the challenges 
facing CFATS, NPPD leadership is committed to receiving input from and, where appropriate, 
collaborating with the regulated community and our Federal, State, and local partners. 

NPPD, ISCD, and the Department are taking our responsibilities for the CFATS program and the 
nation’s security seriously and are moving forward quickly and strategically to address the 
challenges before us. We believe that CFATS is making the nation safer and are dedicated to its 
success. We will make the necessary course corrections to improve the program to better protect 
the nation. 

Legislation to Permanently Authorize CFATS 

We have benefited from the constructive dialogue with Congress, including Members of this 
Committee, as it continues to contemplate new authorizing legislation for CFATS. The 
Department recognizes the significant work that this Committee and others have accomplished to 
reauthorizing the CFATS program. We appreciate this effort and look forward to continuing the 
constructive engagement with Congress on these important matters. 

The Department supports a permanent authorization for the CFATS program and is committed to 
working with Congress and other security partners to establish a permanent authority for the 
CFATS program in Federal law. 

Conclusion 

As the activities described above demonstrate, NPPD is making progress in the implementation 
of CFATS while CFATS is reducing the risks associated with our nation’s chemical 
infrastructure. The Department is not alone in this belief. In August 2011, the American 
Chemistry Council (ACC) conducted a survey of CFATS-regulated facility owners covering 
approximately 800 facilities and received over 1 39 responses. Among other things, the ACC 
survey found that the majority of respondents believe extending CFATS will improve chemical 
security at CFATS-regulated facilities, and that companies have made substantial investments in 
security upgrades as a result of CFATS, and plan to make additional investments following 
ISCD approval of their SSPs. 

As we implement CFATS, w'e will continue to work with industry, our federal partners, states, 
and localities to get the job done, meet the challenges identified in the ISCD report, and 
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effectuate the continuing utility of the program in preventing terrorists from exploiting chemicals 
or chemical facilities in a terrorist attack against this country. 

Thank you for holding this important hearing. I would be happy to respond to any questions you 
may have. 
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Mr. Shimkus. Thank you. 

Now I would like to recognize Mr. Wulf for 5 minutes. There 
might be a button. There you go. 

TESTIMONY OF DAVID M. WULF 

Mr. Wulf. I would also like to thank the members of the com- 
mittee for the opportunity to testify before you today. 

In July of last year, Penny Anderson and I assumed our positions 
as deputy and deputy — director and deputy director, respectively, 
of the Infrastructure Security Compliance Division, or ISCD, the 
division within NPPD that manages the CFATS program. In re- 
sponse to the Under Secretary’s request that we provide a fresh 
perspective on the program, Penny and I produced an internal as- 
sessment of what we see to be the essential priorities, challenges, 
and action items necessary to the success of the program. Both 
Penny and I feel strongly that while the challenges we have identi- 
fied are not insignificant, they also are not insurmountable. I wel- 
come the opportunity to answer any questions you might have on 
the background and context behind the challenges we cited, but I 
would also like to echo the Under Secretary’s focus on the action 
items. 

We have already made tangible progress in addressing some of 
the challenges in the report. One issue identified in the report is 
ISCD’s ability to complete facility’s site security plans — site secu- 
rity plan reviews in a consistent, reasonable, and timely fashion. 
To help overcome past difficulties in meeting this challenge, ISCD 
is utilizing an interim review process that allows the Department 
to authorize Tier 1 facility plans in a more effective and timely 
manner. Using this interim approach, over the past few months 
ISCD has been able to more than quadruple the number of condi- 
tionally authorized plans. Specifically, throughout all of 2010 and 
through November 28, 2011, we had conditionally authorized 10 
site security plans. In the subsequent 2 months leading up to Janu- 
ary 23 of this year, we conditionally authorized an additional 43 
Tier 1 site security plans. ISCD expects to complete our review of 
all Tier 1 site security plans and to notify the facility’s of ISCD’s 
decisions on those plans within the coming months. ISCD also ex- 
pects to begin issuing authorizations to Tier 2 facilities during fis- 
cal year 2012. While this interim review process is underway, we 
are also working on an even more efficient long-term approach to 
site security plan reviews for facilities in Tiers 2, 3, and 4. 

This is one example of how we have identified programmatic 
issues such as the lack of an efficient site security review process 
and found workable solutions to ensure near-term improvements 
and progress, as well as the long-term success of CFATS. While not 
every action item will have a near-term or simple solution, what 
I can tell you is that I am very proud to represent the hardworking 
men and women of the CFATS program and I am confident in our 
ability to address these challenges together. 

I welcome your questions and look forward to working together 
to further the success of this important national security program. 

[The prepared statement of Mr. Wulf follows:] 
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David Wulf Opening Statement 

I would also like to thank the Members of the Committee for the 
opportunity to testify before you today. In July of last year* Penny 
Anderson and I assumed our positions as Director and Deputy Director, 
respectively, of the Infrastructure Security Compliance Division (ISCD) 
- the Division within NPPD that manages the CFATS program. 

In response to the Under Secretary's request that we provide a fresh 
perspective on the program, Penny and I produced an internal 
assessment of what we see to be the essential priorities, challenges, and 
action items necessary to the success of the program, Both Penny and I 
feel strongly that while the challenges we have identified are not 
insignificant, they are also not insurmountable. 

I welcome the opportunity to answer any questions you might have on 
the background and context behind the challenges we cited, but I would 
also like to echo the Under Secretary's focus on the action items. 
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While not every action item will have a near-term or simple solution, 
what I can tell you is that I am proud to represent the hard working men 
and women of the CF ATS program, and I am confident in our ability to 
address these challenges together. I welcome your questions, and look 
forward to working together to further the success of this important 
national security program. 
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Mr. Shimkus. Thank you, Mr. Wulf. What I would ask — I am 
looking also at the staff, I don’t think we have a copy of that and 
some members may want to refer to that, so if I can get staff to 
grab a copy of that and get it copied so that we can distribute it, 
because we did have the Under Secretary’s opening testimony for 
the record. 

With that, I would like to recognize myself for 5 minutes to begin 
questions. I am going to bounce around a little bit, but the first 
one, we are in a very fiscally constrained environment, Under Sec- 
retary, as you understand, and with the challenges that are going 
to occur to our military, 45 billion to 90 billion a year that could 
be cut, we at the national level are going to be looking for every- 
where we can go to try to adjust dollars so that we can meet the 
needs of the primary role of some of the Federal Government’s op- 
erations. 

So let me start with just this whole — this budget type question. 
The Anderson-Wulf memo states on page 15 that ISCD lacks a sys- 
tem for tracking the usage of consumable supplies which creates an 
environment for fraud, waste, and abuse. Our concern is this not 
an IG or GAO saying that, this is a program manager describing 
their own program. How can a member of Congress choose to fund 
a program that is so self-described? 

Mr. Beers. Let me begin the answer to that question and turn 
to my colleague here. The report notes these deficiencies in the pro- 
gram. We had asked for a management review of the program in 
December of last year. That program review was completed while 
this particular report was being prepared and was incorporated 
into the report, and the comments that you see are part of an effort 
by management at the most senior level — that means me — asking 
to make sure that, in fact, this program was working properly. 

I want to turn to Mr. Wulf now to talk about what we are going 
to do about these findings. 

Mr. Wulf. I would just add that, you know, we did not find any 
actual indication of fraud, waste, or abuse with regard to the pur- 
chase and tracking of supplies. We found that a system was not in 
place, and it is something we have already moved forward to ad- 
dress. We 

Mr. Shimkus. Let me reclaim my time, and I — we know there are 
action items. We are going to move forward. But that is obviously 
a major concern that the — that we are going to have to deal with, 
not just the committee ourselves but our colleagues in this whole 
debate. So we will go ahead and follow this. I do appreciate the fact 
that you in July brought Ms. Anderson and Mr. Wulf on board. 

I guess a question would be since you have been on board, Under 
Secretary, since June 19, 2009, what took you so long to have an 
overview of this program? 

Mr. Beers. The initial indications of concern surfaced in the fol- 
lowing year. Prior to that, I had definitely had the sense that the 
program was an evolving program, that changes were being made, 
but they were being made in due course with appropriate diligence 
by the program managers. In July of 2010, I discovered a discrep- 
ancy in the way that people were being paid within the program, 
and moved at that point to correct it. In the fall of 2010, we posted 
an announcement to 
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Mr. Shimkus. And let me — not to be disrespectful, just to move 
to another question, because the timeline is kind of important for 
us because you testified before us March 31 of 2011 and statements 
were made. Again, that is — my comments back to Mr. Waxman 
was, you know, we were given a pretty good signal that things 
were going well. There were small problems but nothing major. 

One of the questions I asked you was about the high-risk tiering 
process and the reasons for a drop in the number of those facilities 
tiered. This is — at that time, I was not aware of any mis-tiering 
problem. Were you? 

Mr. Beers. No, I was not, sir. 

Mr. Shimkus. And that is — if not, when did you first learn about 
the tiering problem? 

Mr. Beers. I first learned about the tiering problem in the begin- 
ning of June of this last year. 

Mr. Shimkus. Was it the earliest time, to your knowledge, that 
DHS personnel discovered that some facilities have been mis-tiered 
was the month that you had given? Was there — in other words, 
were there other folks within the Department that knew that this 
tiering process was all messed up? 

Mr. Beers. There was an indication in May of 2010 that there 
might be a problem with respect to tiering. The individuals within 
the office looked at the problem and felt that they had resolved the 
problem and informed people up the chain of command. I did not 
know that there was a problem at that point in time. I was not in- 
formed of that, and the program went forward from there. 

In 2011, with a new acting director of the office, he asked for a 
review of the program and he discovered that — or rediscovered this 
discrepancy issue and asked for a much deeper dive into that. That 
deeper dive is what resulted in the problem being identified to the 
assistant secretary and immediately to me. And that was in June 
of 2011. 

Mr. Shimkus. And my time is expired. Just so we can move for- 
ward, we are going to continue — obviously we are going to have to 
continue to do oversight over this process and I hope, if there are 
any relevant activities that folks within — under your office that 
have not been doing their job, that through the legal process of re- 
moval that some people can be held accountable, because I do think 
there are probably — if there wasn’t waste, fraud and abuse, there 
may have been. There may be theft and that would be helpful to 
understand that the government can correct bad actors. 

Now I would like to recognize Mr. Green for 5 minutes. 

Mr. Green. Thank you, Mr. Chairman. Secretary Beers, thank 
you for being here. 

As I said in my opening statement, it seems like the problems 
with — for the last 6 years is the inability to hire quality individuals 
and the lack of morale. I think some of that comes from having 
year to year reauthorization. Mr. Wulf said in his statement, but 
I apologize, none of us have a copy of your statement, Mr. Wulf, 
what has been done since the memo was released or since mid-De- 
cember or since it was released on the 23rd, there has been some 
action that has been done that we haven’t heard about except this 
morning. 
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Mr. Beers, do you know Mr. Wulfs statement about some of the 
things that have been done in the last month or so? 

Mr. Beers. Yes, I do, sir. I want to start this response, but I also 
want Mr. Wulf to respond as well. We have looked at the training 
issues that were identified in the report. We have removed the im- 
pediment for hiring training officers within the program so that 
that can go forward, and we have begun to look at the training re- 
quirements in order to take the people who were hired who may 
not have adequate training for that position that they are in. But 
lastly, the other thing that we need to focus on here is we have to 
define what it is we, in fact, expect from our inspectors when they 
are doing the final site authorization inspections and when they 
are doing compliance inspections. David? 

Mr. Wulf. I would add that, you know, we are very excited about 
the progress we have made in the past couple of months on the re- 
view of the Tier 1 site security plans. I believe the progress we 
have made in that regard and the statistics I mentioned are in- 
cluded in the written testimony as well. 

We have a very aggressive plan to move forward with the review 
of the site security plans and to conduct outreach and to get into 
the reviews of the lower 

Mr. Green. OK. I know you gave some hard numbers. I only 
have 5 minutes; in fact, it is down to 3 now almost. 

You gave some hard numbers on what has been done in the last 
30 days. Could you reiterate that? 

Mr. Wulf. Absolutely. We started 2 months ago with 10 Tier 1 
site security plans that had been authorized. We are now at 53. 

Mr. Green. OK, and that is the only hard number that you gave 
in your testimony? Like I said, we don’t have your testimony and 
it is hard to go over something outside 

Mr. Wulf. Absolutely, absolutely. So we have done — we have au- 
thorized 43 or conditionally authorized 43 additional Tier 1 site se- 
curity plans. 

Mr. Green. OK, and 

Mr. Beers. All those were taken from my testimony. Those facts 
are all in my written testimony. 

Mr. Green. OK, but was that based on actually site visits or is 
that from what has been provided by the companies? 

Mr. Wulf. That is based on what has been provided by the com- 
panies, in some instances following compliance assistance visits 
conducted on the sites by our chemical security. 

Mr. Green. OK, let me get to another issue I have talked about. 
I mentioned about the personal security program which was sub- 
mitted on June 14 of last year by OMB and listed as the third pri- 
ority in the DHS memo. I am aware that we need to screen individ- 
uals against the terrorist screening database. As the proposed per- 
sonnel security program would require each facility to submit back- 
ground information on all existing personnel within 60 or 90 days 
upon implementation for existing personnel, any new unescorted 
individuals will not be classified as personnel will need, if they 
have a TWIC card, their information submitted to DHS within 24 
or 48 hours. 

In the real world, we went through a big roll out of the TWIC 
card a few years ago, and it was not as smooth as we would have 
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liked. In fact, I think there are 260,000 TWIC cards issued in our 
district in the port of Houston. And so when you are going to over- 
lay it with a personal security requirement, what did the TWIC 
card not cover that you think we need now under the personnel 
assurity? Because I am concerned about reinventing the wheel, 
even though like I said, it wasn’t — the wheel didn’t run too well 
earlier, but it is running pretty well now. 

Mr. Beers. Sir, let me clear up some perhaps misunderstanding 
of the way we intend to use the TWIC card. We will accept the 
TWIC card as a proof of a background check. We would like to 
know the names of the individuals who come onto the site who 
have TWIC cards in order to determine that the TWIC card is, in 
fact, still valid, but anybody who possesses a TWIC card, that will 
be the standard — that will be an acceptable standard, and anybody 
who might have access to getting a TWIC card can do so to use 
that in lieu of any other background check. 

Mr. Green. OK. I want to make sure that is what was sub- 
mitted, because I have some concern about that. Sometimes what 
we hear and what even passes in law doesn’t get to the final stage. 
Was that submitted that the TWIC card would be the ID when 
submitted to OMB? 

Mr. Beers. David? 

Mr. Wulf. The leveraging of TWIC and other existing creden- 
tials is part of the — was part of the information collected and was 
submitted to OMB. 

Mr. Green. Well, I would feel comfortable seeing in writing what 
you said, Secretary Beers, about the TWIC card because again, we 
have thousands literally, I don’t know how many hundreds of thou- 
sands around the country that we don’t want to also have a break- 
down in redoing something. And I know working with the industry 
and the bargaining units and everything else is something that 
ought to be important. 

And I know I am over my time, Mr. Chairman. I have a number 
of other questions I would like to submit if we don’t have time 
today. 

Mr. Shimkus. Without objection, I thank my colleague and I 
would like now to recognize Mr. Murphy from Pennsylvania, the 
vice chairman of the committee, for 5 minutes. 

Mr. Murphy. Thank you, Mr. Chairman. 

Secretary Beers, the memo states that CFATS must build on — 
in its ability to critically evaluate itself and conduct mid- and long- 
range planning. So to that end, let me ask for your candid re- 
sponses. Why was this not done until now? 

Mr. Beers. I beg your pardon? By whom, sir? 

Mr. Murphy. Why was some of this not done until now in terms 
of really evaluating itself? Was there anything that stood in the 
way of delaying this kind of self-evaluation? 

Mr. Beers. No, sir, there wasn’t anything that prevented it. As 
I indicated to the — earlier, we have had several reviews. This is the 
most extensive one which we have asked for, but we have had sev- 
eral reviews over the course of the program since I became the 
Under Secretary. 

Mr. Murphy. Let me — just for clarification, who sets the CFATS 
goals and objectives for each year? Who is responsible for that? 
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Mr. Beers. I am sorry, sir? 

Mr. Murphy. Who sets the CFATS goals and objectives for each 
year? Who is responsible for doing that? 

Mr. Beers. Sir, the program directors provide those goals. They 
go up the chain of command to the assistant secretary and on to 
me. Ultimately, I am responsible for them. 

Mr. Murphy. Are those public information, in terms of those an- 
nual goals and objectives? 

Mr. Beers. I will have to check, sir. I don’t know whether that 
is public information. 

Mr. Murphy. OK, and how do you measure those goals and ob- 
jectives? Is that something you have in terms of internal docu- 
mentation of how you review those? 

Mr. Beers. Sir, let me ask David Wulf to answer that. 

Mr. Wulf. There are established performance metrics that we 
prepare and send up the appropriate chains. The performance is 
measured with respect to things such as numbers of inspections 
conducted, percentage of inspections conducted as compared to the 
totality of the regulated community. 

Mr. Murphy. Well clearly from the evaluations, things that you 
are talking about — and I add my comments to the chairman’s in 
terms of we appreciate getting your candor on these. But in addi- 
tion is who would like know, are these factors — are these evalua- 
tions somehow factored into employee compensation, such as raises 
or bonuses? 

Mr. Beers. Sir, as a general matter with respect to the entirety 
of NPPD performances factored into the issue of bonuses or pro- 
motions, Dave, do you want to add anything specifically? 

Mr. Wulf. I would echo the Under Secretary’s sentiments. Meet- 
ing our performance goals is and will be a significant measure for 
us in assessing allocation of bonuses. 

Mr. Murphy. Do you know if any of the CFATS employees or su- 
periors received a bonus since 2009? 

Mr. Wulf. I am sorry, sir, could you repeat that? 

Mr. Murphy. Do you know if any of the CFATS employees or su- 
pervisors or superiors received any bonus since 2009? 

Mr. Wulf. I don’t have that information. We could 

Mr. Murphy. Would you let — it may be helpful to this committee 
if you would let us know in conjunction with some of the informa- 
tion given. We would appreciate that. 

Let me also say, the Anderson-Wulf memo that you have states 
that employees felt uncomfortable delivering bad news to superiors. 
So to what extent does the failure to inform you caused by this 
chill work environment, and who chilled the environment that — 
was it you, someone else? Who in the chain of command had that 
effect? Secretary Beers? 

Mr. Beers. Sir, let me start in answering that. I have said as 
a management principle based on my 40 years in government that 
I appreciate hearing bad news and I don’t want to hear bad news 
from anybody else. This particular issue has been used as a teach- 
ing moment by me for the entirety of my workforce, because no 
one, no one should feel that they can’t tell me bad news, because 
bad news is usually something that we can do something about, 
and if we don’t hear it, we can’t do anything about it. I can’t speak 



31 


to the culture within the office that — and the words in the report, 
but I want you to understand that to all of the people who work 
for me, I say that time and again. I am perfectly prepared to hear 
bad news, and I really don’t want to hear from somebody outside 
the organization. 

Mr. Murphy. As a Navy officer, I admire a Marine officer saying 
that. I recall the former chairman of the Joint Chiefs of Staff, Ad- 
miral Mullen, saying that as he climbed the chain of command the 
food got better and the news got better, too. Unfortunately, it is im- 
portant to have that bad news coming up. 

So are you confident now that you are getting full accurate infor- 
mation, full disclosures on CFATS information? 

Mr. Beers. Sir, I have complete confidence in Penny and David 
making sure that that information comes to me, and they know 
that I want to hear it and they know that I want to fix problems 
that they surface to me to the extent that I have the power to fix 
it, so yes. 

Mr. Murphy. Mr. Chairman, I am over my time. Could I ask Mr. 
Wulf to give an answer to the same question? 

Mr. Shimkus. Yes. 

Mr. Wulf. Sir, I can confirm that Director Anderson and I re- 
ceived the message the Under Secretary was just discussing that 
he wants the bad news within the first week or two of our arrival 
on the job, and that is very much the spirit in which this report 
was written for him. Yes, within the organization I can’t nec- 
essarily speak to how the culture evolved, but I can tell you that 
Penny and I have gone to great lengths to create a culture of trans- 
parency, a culture in which our employees are not afraid to raise 
issues that they view as problems. We have an open door policy. 
We have all hands on meetings on a regular basis, and we have 
made it clear that we don’t tolerate repression of concerns that 
folks may wish to bring up. 

Mr. Murphy. Thank you very much, Mr. Chairman, I yield back. 

Mr. Shimkus. Let me, before I yield to the chairman emeritus, 
Mr. Dingell, let me ask unanimous consent for 5 days for members 
of the subcommittee to submit opening statements for the record. 
Without objection, so ordered. 

Now I would like to recognize Mr. Dingell for 5 minutes. 

Mr. Dingell. Mr. Chairman, thank you for your courtesy. 

Secretary Beers, why did you commission a top-to-bottom study 
of this program? 

Mr. Beers. Sir, when it became evident to me that, one, we had 
a re-tiering issue that was brought to my attention in June, and 
that we had had an issue about locality pay and we had had a 
slowness in terms of the approval of site security plans, that I 
needed to make sure that the new management which we had 
brought in to take over the program and make sure that it was 
running solidly brought their full attention to giving me as accu- 
rate a picture as possible in this program. 

As I said earlier, we had already commissioned a management 
study which was completed during the time that the report was 
prepared, and that was part of the report as well. So the final re- 
quest of Penny Anderson and David Wulf was the result of an in- 
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creasing concern on my part that the program was not running 
well. 

Mr. Dingell. Thank you, Mr. Secretary. 

Now, is Department of Homeland Security working to engage the 
industry in helping to get this program successfully implemented? 
Yes or no. 

Mr. Beers. Absolutely yes. 

Mr. Dingell. Mr. Secretary, I know there has been some con- 
troversy recently regarding some misclassified facilities. Can you 
assure me and the members of this subcommittee that you have 
properly addressed this issue and that you have correctly identified 
high-risk facilities? Please answer yes or no. 

Mr. Beers. Yes. 

Mr. Dingell. Now these questions to Mr. Wulf. 

Mr. Wulf, as your internal memo points out, there have been a 
number of challenges in implementing this program. Do you believe 
that the program is fixable? Yes or no. 

Mr. Wulf. Yes. 

Mr. Dingell. You do agree or believe it is? 

Mr. Wulf. Absolutely. 

Mr. Dingell. Thank you. 

What are the top two or three things that need to be addressed 
to bring this about, in your opinion? The top two or three things. 

Mr. Wulf. I would say the SSP, the site security plan review 
process, which we have already begun to move forward consider- 
ably over the last 2 months, and preparing our inspectors and 
our — the rest of our team to move forward and conduct authoriza- 
tion and compliance inspections. 

Mr. Dingell. Now what progress have you and the Department 
made in addressing these issues? 

Mr. Wulf. We have quadrupled the number of Tier 1 site secu- 
rity plans that we have conditionally authorized just over the last 
2 months. We have commissioned an inspector tools working group 
as well to develop the standard operating procedures, other poli- 
cies, and to determine what tools our inspectors will need as we 
move forward to the next stages of this program to actually conduct 
authorization inspections and to get into the regular cycle of com- 
pliance inspections moving forward. 

Mr. Dingell. Thank you, Mr. Chairman. You will note I re- 
turned 1 minute and 27 seconds. Thank you. 

Mr. Shimkus. Thank you, Mr. Dingell. 

Now I would like to recognize the gentleman from New Hamp- 
shire, Mr. Bass, for 5 minutes. 

Mr. Bass. Thank you very much, Mr. Chairman. 

I am not as familiar with the substance of this program and its 
history and so forth. I don’t have a lot of facilities in my area. I 
am, however, very concerned about this memo. We have oversight 
responsibility, and to some extent, we are as vulnerable, if you will, 
to criticism for failure to be — to perform adequate oversight and be 
vigilant about the use or abuse or alleged abuse of taxpayers’ 
funds. And that is why this memo is bipartisan, because we all 
know that we have a responsibility to make sure that the govern- 
ment is run well. 
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I am also a businessman, and have over my life hired and fired 
people to do things. I don’t like to fire people, but it happens. Mr. 
Beers, if you were in my position, looking at this report, would you 
consider yourself to have done a good job on your role to date? 

Mr. Beers. Sir, as I have said publically before, I hold myself re- 
sponsible for this — these sets of problems, and I am committed to 
fixing them. 

Mr. Bass. If you were your own boss, would you keep you on the 
job? 

Mr. Beers. I can’t answer that question, sir. 

Mr. Bass. I mean, do you — have you considered the possibility 
this might not be the right role for you, and it might be time for 
you to step aside? Mr. Barton referred to it in his opening state- 
ment. 

Mr. Beers. Sir, I consider that every day I work for the Federal 
Government. I swore an oath of office on at least three occasions 
to protect and defend the Constitution of the United States, and I 
believe in that. And if I believe I can’t do the job, then I will walk 
away from it as I have done before. 

Mr. Bass. Do you think it is unusual to have an action memo 
that for all intents and purposes, you are not really disputing, with 
70 different recommendations, a lot of which are noted in progress? 
You also noted in your testimony or answered a question a minute 
ago that you could address these issues “to the extent that I have 
the power to fix it.” Do you have the power to fix these — all of 
these problems? 

Mr. Beers. As far as the issues within this particular action 
plan, yes. 

Mr. Bass. So would you 

Mr. Beers. But with respect to Mr. Green’s comment about 
TWIC cards, no, I can’t make the TWIC card be broader than the 
current authorization of the TWIC card, which means that you 
have to be a transportation worker. 

Mr. Bass. All right. Well, Mr. Beers, this is a disturbing memo. 
We appreciate the fact that it has come to our attention, and I cer- 
tainly hope that we — that you understand that most of us haven’t 
seen anything like — this is a very unusual and unusually poorly 
run agency. If it is not going to — if at any time you believe that 
you are not the right person to turn this troubled agency around, 
that maybe there ought to be a different managing structure. 

So having made that point, I think — I hope that the committee 
will carefully watch the progress in this action plan, because the 
American taxpayers are not going to stand for this kind of alleged 
or perceived incompetence in management for this very important 
agency to our Nation’s security. 

Mr. Shimkus. Would the gentleman yield to me 

Mr. Bass. Yes, sir. 

Mr. Shimkus [continuing]. For the remainder of your time? 

I want to follow up on this. We really got to get a handle on this 
card issue, and we would like for you to provide us your legal opin- 
ion of why you cannot deal with this TWIC card. We think you can. 
We, and that is the Energy and Commerce Committee, have been 
in discussions with Homeland Security for months trying to resolve 
this. We think it is within your jurisdiction and if it is not, we 
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would like to see the legal reasoning why it is not so that we can 
change the law. We think it is within your power now, and I think 
my friend, Mr. Green, would be very pleased if we can get a handle 
on this. So help — work with us. This is an issue, again, that was 
brought up in the March — in March of last year’s hearing that we 
thought we were moving in some direction, and there have been 
multiple consultations with Homeland Security, and we are not any 
further than we were in March of 2011. 

I would like to yield to my colleague. 

Mr. Green. If the chairman would yield? I know we went 
through this last year, and because the TWIC card is under De- 
partment of Transportation and Coast Guard, I know there is an 
issue with Homeland Security. I just don’t want to reinvent the 
wheel, because so many times those same workers that work on 
the dockside are also at an inland plant. And so that is why I 
would hope with interagency agreement, although in 908 earlier 
this year our committee passed, we gave that authorization there 
language, but it hasn’t passed and hadn’t passed the Senate, so we 
need to work on it. 

Mr. Shimkus. And reclaiming the time, I would just say that 
Coast Guard is under Department of Homeland Security. This 
should not be difficult to do. 

Now I would like to recognize Mr. Pallone, my colleague from 
New Jersey, for 5 minutes. 

Mr. Pallone. Thank you, Mr. Chairman. 

We are here this morning to discuss issues facing the Chemical 
Facility Anti-Terrorism Standards, or CFATS, program, and we are 
talking about this leaked DHS internal memo from 2011 that clear- 
ly shows that DHS faces serious implementation problems with the 
CFATS program, most notably that the Department has received 
4,200 site security plans but has yet to approve a single one. The 
CFATS program was enacted as a rider to the 2007 Homeland Se- 
curity appropriations bill in order to give Congress time to enact 
comprehensive legislation, and we did just that in the 111th Con- 
gress by passing H.R. 2868 in the House. That bill provided a com- 
prehensive security program to protect Americans living near these 
facilities, but unfortunately the Senate did not take it up. 

I am not here to claim that H.R. 2868 would have magically fixed 
all the problems outlined in the DHS memo, but it certainly pro- 
vided a much stronger framework to protect the more than 100 
million Americans that live in the danger zone of a chemical dis- 
aster. 

Last May, this committee had the opportunity once again to exer- 
cise its jurisdiction and set forth a full authorization of this pro- 
gram to replace the vague and inadequate CFATS program enacted 
in 2007. Unfortunately, the committee decided not to address short- 
falls with the CFATS program, and just moved a simple extension 
of the current law. 

Mr. Chairman, in New Jersey we have the unfortunate combina- 
tion of both a large number of chemical facilities and a high popu- 
lation density, so the consequences of insufficient security are dire. 
I regret that this committee has not taken a more proactive ap- 
proach to securing these facilities, and I will continue to push for 
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a more comprehensive security program to ensure the safety of my 
constituents living in the shadow of these facilities. 

Now to questions. The November 2011 DHS report begins to ex- 
plain why nearly 5 years after these regulations went into effect, 
not a single site security plan has been approved. It reveals that 
this committee was rash, in my opinion, in passing legislation to 
rubber stamp the program for 7 years without investigating or ad- 
dressing the program’s shortcomings. Many of us have heard from 
those in the business community that the CFATS program is still 
strong and that businesses have done everything that they are re- 
quired to do under the program. According to industry representa- 
tives, we should be comforted to know that companies have acted 
prudently and are prepared for compliance inspections, should the 
Department ever begin to conduct them. 

I hope this is true, but our national security is inherently a gov- 
ernmental function. Many members of this committee have worked 
for years to establish a robust regulatory structure for chemical fa- 
cility security, and none should be satisfied with the suggestion 
that approvals and inspections are insignificant or that the role of 
the Department in this program is insignificant. 

Now Under Secretary Beers, do you think that the Department 
of Homeland Security should play a role in ensuring that our chem- 
ical facilities are secure? 

Mr. Beers. Sir, I strongly believe that the Department has a role 
and that the office that is tasked with doing that can play that 
role. 

Mr. Pallone. Do you think that the Department must play a 
role? I mean, do you think that it is absolutely necessary that they 
play a role? 

Mr. Beers. I am sorry, sir? 

Mr. Pallone. Do you think that the Department must play a 
role, that it is absolutely crucial that they play a role? 

Mr. Beers. I think that the original intent of the Act is abso- 
lutely appropriate, and yes, the Department must play a role. 

Mr. Pallone. Would you say that site security plan approvals 
and compliance inspections are necessary and important to ensure 
chemical facility security? 

Mr. Beers. I think that they are absolutely essential to making 
this program work effectively. 

Mr. Pallone. Well, I mean, I agree with everything you have 
said, and I think the failure of the Department to complete security 
plan approvals and compliance inspections is a very serious issue. 
I am glad to see that the Department is treating it as such, and 
I welcome the opportunity to work together towards a strong and 
effective program. 

But I guess the point I am really trying to make here is that this 
committee has a responsibility to put together an appropriate com- 
prehensive authorization bill, and not simply rely on this para- 
graph or whatever it is, I mean, it is like this long, in an appropria- 
tions bill that really doesn’t give you sufficient guidance or man- 
dates or inspection or enforcement capability to do what you have 
to do. So I am not — I understand that there are all kinds of prob- 
lems with the Department, but I think a big part of the problem 
is that you never had a comprehensive authorization bill to tell you 
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what to do and to give you the authority what to do. I mean, we 
could sit here all day and talk about how bad you are, and you 
know, there certainly are problems, but I think that it is our re- 
sponsibility to do something more comprehensive to provide the 
guidance, Mr. Chairman. That is my only point. Thank you. 

Mr. Shimkus. The gentleman yields back his time. 

The chair now recognizes the gentleman from Ohio, Mr. Latta, 
for 5 minutes. 

Mr. Latta. Thank you, Mr. Chairman, and gentlemen, thanks 
very much for being here today. We have such short little time to 
ask all these questions, but if I could, first, is it my understanding 
and am I correct in hearing that we spent about — $480 million has 
been appropriated for the program since its inception? Is that cor- 
rect? 

Mr. Beers. Yes, sir, I believe that is the right number. I can give 
you the exact number if you want. 

Mr. Latta. OK, but that is a ballpark. Thank you. 

And as Chairman Emeritus Dingell does, he is very good at get- 
ting his rifling in on his questions, yes or no, but one thing I want 
to go back to is the question about working with industry. You said 
that you are working with industry, but you know, as we — reading 
the report that came through and looking at the site security plan 
that, you know, again as has been said a little bit earlier, that we 
have received — that you have received about 4,200 SSP submis- 
sions and that none have been approved. 

Did you ever hear from industry during this timeframe that gee, 
what is going on? These things have been submitted but we are 
never hearing back from the Department. 

Mr. Beers. Yes, we did receive inquiries from the industry about 
when they were going to be approved. 

Mr. Latta. Do you know how many inquiries you have been re- 
ceiving? 

Mr. Beers. I don’t have that information at the tip of my fingers, 
sir. 

Mr. Latta. Do you know when you might have received the first 
inquiry? 

Mr. Beers. Excuse me? 

Mr. Latta. Do you know when you might have received the first 
inquiry from industry as to when they might have these approved? 

Mr. Beers. No, I can’t tell you precisely when, but I can get you 
that information. 

Mr. Latta. OK, because again, going back to the earlier testi- 
mony that when you are looking at, you know, those 5-1/2 years 
since the enactment of CFATS, and that is also the stats of the 
statute itself, and 4-1/2 years since the final rule. It kind of — I 
really would like to find out when these — the industry that was 
being regulated was finding out if they were or not being approved, 
because you know, there is quite a timeframe there. 

Let me go to the other thing that Mr. Wulf had brought up a lit- 
tle bit earlier saying that, you know, there is going to be an — and 
I am sorry, again, I don’t have it in front of me but I just kind of 
wrote it down — saying that you are going to have an open door pol- 
icy and not afraid to raise issues. The reason I bring this up is I 
was a county commissioner for 6 years, years back, and we had 
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about 1,100 employees in the county. We regulated all kinds of 
things. We had a lot of different departments. It wasn’t unusual for 
an employee that worked in one of those departments that served 
underneath the Board of Commissioners to bypass their super- 
visors and call me at home, or being from, you know, a county of 
125,000, they would run into you at the county fair, they would 
talk to you at the grocery store, or they would say can I talk to you 
someplace else? Did you all get any contact from anybody at any 
time saying gee, I would like to talk to you about something that 
we think there is something wrong going on with the program? 

Mr. Beers. Sir, on this particular program, yes, and that is part 
of the reason that some of the efforts in order to investigate prob- 
lems took place in the past. 

With respect to bypassing the chain of command, in order to pre- 
vent that particular problem, we in management and I in par- 
ticular have meetings with either individuals or groups of people 
throughout NPPD that are well down in the chain of command in 
order to elicit their thoughts and suggestions so that we can im- 
prove the program overall. 

Mr. Latta. OK, let me ask you this question. Do you know when 
you might have started first getting an inclination that there was 
something wrong with people contacting you, going — bypassing the 
chain of command to say, you know, there is something really 
wrong here in personnel or the way the program is being run? 

Mr. Beers. — that I can report to you on is in the — excuse me. 
The first instance that I can report to you that this occurred would 
be in the summer timeframe of 2010 when it came to our attention 
because of a report by an individual that there seemed to be a 
problem with the locality pay. As soon as we found out that that 
was an issue, we took that on and went through the process to de- 
termine what had gone wrong in terms of the appropriate pay to 
the individuals involved. 

Mr. Latta. So this would be actions. So the first inclination 
would be a couple of years after the program was put in place, 
would that be correct? 

Mr. Beers. Yes, sir. 

Mr. Latta. OK, thank you. 

And just real quick, I know my time is running out, Mr. Chair- 
man, but if we could get some of that information back because 
again, you know, I really, really hope that that open door policy 
really does exist and that folks aren’t afraid to come forward, be- 
cause this has got to work. Again, when you look at the number 
of — with 4,200 SSPs that have been submitted and trying to get 
these things caught up, it is very , very important not just for the 
Department itself, but for all those industries out there trying to 
comply. 

And with that, Mr. Chairman, I yield back. 

Mr. Shimkus. Gentleman yields back his time. 

The chair now recognizes the gentleman from Georgia, Mr. Bar- 
row, for 5 minutes. 

Mr. Barrow. I thank the chair. I would like to yield my time to 
the ranking member of the subcommittee, brother Green from 
Texas. 
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Mr. Green. Thank you. I am going to revisit the personnel 
assurity, but Mr. Wulf — and I appreciate the update that you had. 
I saw your testimony and I am going to encourage the chair that 
maybe two or three months from now, we invite you back to enjoy 
our hospitality again and see how far along we are, because this 
is such an important issue or a lot of areas. I know Mr. Pallone 
and mine, we have substantial chemical facilities that are not wa- 
terside based. 

Let me get back to personnel assurity program, because that is 
something that is sensitive, because I have plenty of plants on the 
water, but also plenty of plants that are not. The same company 
owns them, and often times they transport personnel back and 
forth. My concern is what was submitted from the OMB that the 
OMB did not recognize that the TWIC card, from what you said in 
your testimony, would be used. And I can understand why some- 
thing regulated by your agency can’t apply for a TWIC card. But 
it seems like in the Federal Government we could use the same 
database. The Coast Guard, Department of transportation, the 
TWIC card, and use the same database for the background and the 
TWIC card would be interchangeable. 

And my idea, and I can tell you, you know, some of my folks are 
going to be frustrated if they end up having to pay another few 
hundred dollars to get a second card because their company trans- 
fers them some where and not all companies are really nice and 
they say no, that is part of your requirement for the job. You have 
to have your driver’s license to drive the company car. So that is 
my concern. The proposed personnel assurity program will require 
facilities to submit background information on all existing per- 
sonnel within 60 or 90 days upon the implementation, and any new 
unescorted individuals who are not classified as personnel would 
need — even if they have a TWIC card, their information submitted 
to DHS 48 hours in advance. Was that part of the submittal to 
OMB, because that doesn’t sound like you are getting TWIC cards 
consideration. 

Mr. Beers. Sir, I believe that is part of the submittal to OMB, 
and what I am trying to convey here is that we are looking at all 
of the opportunities to leverage the various cards and want very 
much to go in the direction that you want to go. 

Mr. Green. OK. Well — and I know there may need to be an 
interagency memorandum to work together, and I know sometimes 
our Federal agencies don’t like to do that, but we have — it is redun- 
dant information if we are using the same database. And I don’t 
understand why DHS, as we proposed in two separate legislations 
earlier, harmonized TWIC with the leverage and the operational — 
the background checks. Is there a justification or an incident that 
I am not aware of that have existed within the TWIC system that 
would require DHS to go beyond TWIC? 

Mr. Beers. I am not aware of any, sir. 

Mr. Green. OK. And it seems to be — because I try and stay pret- 
ty close to the ground there with a lot of my folks, and I have not 
heard on. In our area, people may not like some of the chemicals 
that we produce, but they are things that we don’t — they produce 
them because somebody needs them in our country, and we want 
to make sure they are safely produced both for the people that live 
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around it, but the folks on that plane. Every time I talk about the 
issue with DHS, you assure me they incorporate TWIC. I just want 
to make sure it goes forward from that, and I think maybe we will 
even contact OMB and express that concern that don’t reinvent the 
wheel, even though we have two separate Federal agencies and 
hopefully that would come from both agencies, including Depart- 
ment of Transportation. They use the same database that you 
have. 

Mr. Chairman, I don’t have any other questions. I would be glad 
to yield back to my colleague from Georgia, and I appreciate his 
courtesy. 

Mr. Shimkus. The gentleman from Georgia yields back his time. 
Chair now recognizes the gentleman from Mississippi, Mr. Harper, 
for 5 minutes. 

Mr. Harper. Thank you, Mr. Chairman, and I certainly thank 
the two of you for being here today, and Mr. Wulf, I want to thank 
you and Ms. Anderson for the work that you have done on this. 
This may come as a shock, but you know, it is not always sur- 
prising to us to learn that an agency may be dysfunctional. So this 
is not always a surprise. 

But we appreciate the candor and no one should ever be criti- 
cized or subject to anything for being very open, which you and Ms. 
Anderson have done, so I thank you for that. I believe that gives 
us some input. 

But I wanted to ask you a few questions, if I may, Mr. Wulf? 

You know, as I looked through the report, one of the things that 
you spent some time on was the issue of unions within the organi- 
zation. Can you tell me when the workforce in the division was 
unionized? 

Mr. Wulf. I can’t give you an exact date on that. It was before 
Ms. Anderson’s and I arrival, but I want to say spring of last year, 
maybe March. 

Mr. Harper. Well let us — can you tell me, does each worker have 
to cast a vote in order for their votes to be recorded, as far as do 
you know how the process works? Non- voters are considered voters 
to unionize, how that is counted? 

Mr. Wulf. I am not completely certain about that process. 

Mr. Harper. Can you get me that information? 

Mr. Wulf. Absolutely. 

Mr. Harper. That would be great. Can you tell me how many 
employees there are in the CFATS program, and how many are eli- 
gible to be represented by government unions, and how many af- 
firmatively voted to be represented by unions? 

Mr. Wulf. I don’t have the totals on the voting, and I will say, 
there are approximately — and I don’t have the exact numbers in 
front of me — a little more than 200 Federal employees in the 
CFATS program. Of those who would be eligible for union — or to 
vote in a union membership, that would be our field force, non-su- 
pervisory field force, so a little bit under 100 of those. 

Mr. Harper. At the time of unionization, were all programmatic 
and accountability measures and job descriptions in place that ap- 
plied to that workforce? 

Mr. Wulf. As we noted in our report, we are continuing to refine 
the requirements for the sections and 
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Mr. Harper. Well, explain what — when you started out in your 
report and you said that the presence of the union at this stage in 
the program will have a significant negative impact, explain that. 

Mr. Wulf. I appreciate the opportunity to provide a little addi- 
tional context to that. 

Mr. Harper. Yes. 

Mr. Wulf. The report was not intended to be a statement con- 
cerning whether unions and Federal workforce are good or bad, but 
rather a recognition of the fact that this is a program that is very 
much in its emerging stages, and we are very much in the midst 
of putting into place policies and procedures for the conduct of in- 
spections, for the operation and review of site security plans, and 
so forth. 

So it certainly adds a layer of complexity that wouldn’t otherwise 
exist. That said, though, along with the union we have very much 
a shared interest in moving the program forward in a collaborative 
relationship. 

Mr. Harper. Certainly. We have an overall big picture here of 
an issue of national security that we have now kind of gotten 
bogged down and does it not make it more difficult, though, after 
the unionizations take place to implement some of these policies? 
Are you not already seeing that even on the reference that you had 
to the mileage reporting? 

Mr. Wulf. It does add a layer of complexity, but it also, I think, 
adds voices in the development of policy that will allow us to de- 
velop more sustainable processes moving forward. 

Mr. Harper. What was it, 16 weeks that you reported for the 
mileage requirements to be done? 

Mr. Wulf. I believe that was the estimate. 

Mr. Harper. While I understand the need, everybody has got to 
work together. The fact is that this has caused delay, has it not? 
Why don’t I not make you answer that question. I think we know. 

I appreciate your time, Mr. Wulf, and for you and Ms. Anderson 
to be so candid with your situations. Thank you. 

Mr. Shimkus. The gentleman yields back his time. 

The chair recognizes the gentlelady from California, Ms. Capps, 
for 5 minutes. 

Mrs. Capps. I thank the chairman for recognizing me, and I 
apologize for the state of my voice, but I am feeling well. I am 
pleased to be here and I think you both for your testimony. 

The internal Homeland Security report from November, 2011, 
provides new support for concerns that problems in the statutory 
language creating the CFATS program hindered its successful im- 
plementation. And of course, we are talking about Homeland Secu- 
rity here. According to the report, CFATS personnel have not yet 
determined how to systematically review site security plans. Al- 
though the Department has set up an interim process to try to get 
these plans reviewed, staff are still working to develop a process 
to be used over the long term. Apparently, many initial site secu- 
rity plan reviews have to be redone. The November reports states 
that they have been found to be, and this is a quote, “inconsistent 
with the spirit and intent of the program’s mandate.” 

Mr. Beers, can — would you please elaborate on what the report 
meant when it stated that site security plan reviews had not been 
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conducted consistently with the spirit and intent of the statutory 
mandate? 

Mr. Beers. Madam, I can’t specifically speak to the reason be- 
hind that. I can give you some broader context about what hap- 
pened with respect to the efforts to get site security plans that, in 
fact, met the requirement. 

As the program was rolled out and as it evolved, the guidelines 
for the information that needed to be provided in the site security 
plans failed to elicit appropriate responses from industry. Some of 
that undoubtedly was or could have been done better if the guide- 
lines that we had put out had been more clear and some of it was 
simply on the part of industry not providing that information. I 
don’t mean to suggest in any way that that was an intentional act, 
but it required us to go back to those particular facilities and ask 
for more information in order to be able to get to a site security 
plan that, in fact, appeared to meet what we needed to have in 
order to have a site security plan. That iterative process ended up 
taking time when those site security plans were initially filed, and 
that is part of what I regard as the due diligence that we and in- 
dustry need to undertake together in order to ensure that a plan 
that is finally authorized and approved is a plan that is capable of 
providing the kind of security that you all have charged us to build. 

But let me turn to Mr. Wulf about the specific comment 

Mrs. Capps. And I wanted — yes, briefly if you would, please, so 

1 can go on to another question. 

Mr. Wulf. About the site security plan review process specifi- 
cally? 

Mrs. Capps. Well, it is just why — I am very concerned that these 
delays have occurred. 

Mr. Wulf. Yes, we have taken steps to address those through 
the implementation of our interim review process, and as the 
Under Secretary and I have mentioned, you know, we, in the last 

2 months, quadrupled the number of SSP — of site security plans we 
have been able to authorize, and I think the future is bright mov- 
ing forward on that path. 

Mrs. Capps. I thank you for that, you are trying, and I appre- 
ciate the Department is working to address these issues and estab- 
lish a consistent site security plan review process. 

I am concerned, however, that flaws in the law make ambiguity 
and consistency in the review process unaffordable. I mean, you 
may have taken care of this one, but it is going to pop up again. 
That is because Section 550 grants discretion to the Secretary to 
approve site security plans that fail to meet the risk-based per- 
formance standards under this program. The law says only that the 
Secretary may disapprove a plan that fails to meet those stand- 
ards. 

As many of this committee will perhaps recall — I recall it well, 
because I offered an amendment during the markup of H.R. 908 
that would have changed that word “may” to a “shall” to require 
that site security plans be disapproved if they failed to meet per- 
formance standards. That word “may” is what causes the ambi- 
guity and the having to go back and re-question, and time is of the 
essence when we are talking about Homeland Security. 
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So Mr. Beers, back to you again. Do you agree that site security 
plans failing to meet the standards should be disapproved? 

Mr. Beers. Congresswoman, our objective here is to get the yes, 
so the notion of disapproval doesn’t necessarily accomplish that. 
The point is, when we say we are not prepared to approve it, that 
is the functional equivalent thereof. But what we want to do is 
have a cooperative relationship 

Mrs. Capps. Right. 

Mr. Beers [continuing]. With industry in order to say whether 
or not a plan requires more information or more clarification. 

Mrs. Capps. And industry needs to have this as well. May I just 
finish one sentence? 

Mr. Shimkus. We are trying to get these in before the votes on 
the floor. 

Mrs. Capps. Well, I believe that it should be a requirement so 
that industry is clear about what they need to do. 

Mr. Shimkus. The gentlelady’s time is expired. 

The chair now recognizes the gentleman from Louisiana, Mr. 
Cassidy, for 5 minutes. 

Mr. Cassidy. Thank you. The memo is — one, let me just com- 
mend you for asking it be drawn up. On the other hand, obviously 
it paints a disaster in terms of acquisition, inventory management, 
attitudes, I mean, it is just a total indictment. Now, as a guy that 
represents an area with lots of PETRA chemicals, lots of businesses 
and workers dependent upon this, if I concede the argument that 
your job is important for safety, it frankly seems not just an indict- 
ment of your organization, but it frankly seems to place my con- 
stituents at risk. 

Now that said, how many employees does this particular division 
of DHS have? 

Mr. Wulf. I want to say 206. 

Mr. Cassidy. Two hundred and six? 

Mr. Wulf. I believe so. 

Mr. Cassidy. Now, this problem seems so endemic. How many 
have been fired? I mean, it seems like an easy target because they 
speak consistently of people being hired because they know some- 
body. People who are — I mean, you list — you can almost write 
somebody’s name in here if you only have 206 people. So clearly, 
it wasn’t how many have been fired. How many are going to be 
fired? 

Mr. Beers. Sir, with respect to the issue about the re-tiering 

Mr. Cassidy. No, I mean, just a simple question. I mean, clearly 
there is an endemic problem here, and it is rife. How many have 
been fired? It is a pretty simple question if you only have 206 em- 
ployees, and how many do you have on the chopping block? 

Mr. Wulf. Sir, with respect to the leadership of the organization, 
the people who were in the leadership positions in the organiza- 
tion — 

Mr. Cassidy. I only have 3 minutes. Can I have a number? 

Mr. Wulf [continuing]. Have moved on. 

Mr. Cassidy. How many? 

Mr. Wulf. That is two people. 

Mr. Cassidy. OK, so two out of 206, one percent, and yet we have 
people here hired, apparently, because they know somebody, pro- 
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moted because they know somebody, apparently fudging on their 
gas reports. We only have two, only one percent? It seems like the 
organization — and I don’t mean this to be kind of snitty, but I am 
just amazed that we are tolerating this level of incompetence. 

Now I am struck. In your document here, you say that — I am 
quoting from page nine — “We have yet to approve a site security 
compliance inspection. Moreover, we have not yet determined what 
it will look like. And yet, since this report was reported in the 
news, we have quadrupled the number of compliance reports 
issued.” Is that my understanding, or do I understand incorrectly? 

Mr. Wulf. It is — what we quadrupled is the number of site secu- 
rity plans we have conditionally authorized, which the step that 
precedes the conduct of an authorization inspection, which then 
leads to the final approval of a facility’s site security plan, sir. 

Mr. Cassidy. OK. So the indictment of the report stands that we 
are 6 years into this, and we have yet to come up with a compli- 
ance inspection program. I just don’t know what to say. 

Now, I do know what to say. Clearly, there are ways to contract 
this out. I don’t know how you just don’t start over with this pro- 
gram, but I understand the Coast Guard has the authority to use 
an alternative security program. Can we use an alternative secu- 
rity program? I understand, again, you have this authorization al- 
ready. Can we use that now since it looks like the current program 
is so dysfunctional to be beyond restitution? 

Mr. Beers. Sir, the short answer is yes, and I will let David de- 
scribe what we have done with respect to that. 

Mr. Wulf. We do already have some alternative security pro- 
grams that have been submitted by industry stakeholders, and we 
are working very aggressively in partnership with our industry 
stakeholders to develop some templates that can be used. We can’t 
prescribe a specific template, but we are going to work through 
some templates that will — the hope is allow for more expeditious, 
speedy review and approval of 

Mr. Cassidy. But this does not include contracting out this func- 
tion, correct? Can you go to a third party to conduct these inspec- 
tions? I mean, what you describe here is a staff which is poorly 
hired, poorly trained, and has a poor attitude and has a sense of 
law enforcement wanting to clear — be called commander and wear 
pistols as opposed to actually go through and look at something in 
terms of compliance. 

Mr. Beers. Sir, compliance inspection is an inherently govern- 
ment function. We have to have the people who do that be Federal 
employees. 

Mr. Cassidy. Now it is my understanding, though, that the Coast 
Guard actually has an alternative standard, and frankly, Bummerd 
now has it, the whatever they call the offshore for the oil rigs. They 
have a third party that is inspecting oil rigs. 

Mr. Beers. I can’t speak to the Coast Guard, sir. I am not aware. 

Mr. Cassidy. OK. I have much more to ask. 

Mr. Shimkus. The gentleman yields — they also have some con- 
tractors doing TSA function at some of the airports. It is worth 
looking into. 

I would like to yield now 5 minutes to the ranking member of 
the full committee, Mr. Waxman, for 5 minutes. 
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Mr. Waxman. Thank you, Mr. Chairman. 

None of us can be happy about this memo that came out last No- 
vember, showing how poorly this program is serving the American 
public. This is a serious matter. This is a matter of national secu- 
rity, possible attacks by terrorists on chemical plants. I note that 
all of us are concerned, not just the people here in the Congress, 
but Mr. Beers and others in the administration. We have a stark 
and troubling picture, but perhaps there is a silver lining, because 
it appears to me that the Department is taking the situation clear- 
ly- 

But I want to talk about Congress’s role. It is easy at a hearing 
like this after we get a report of a failure to beat up on the people 
running the program. But Congress has a responsibility as well. 
This program was established in an appropriations bill, not a bill 
that came out of this committee. It was a rider on an appropria- 
tions bill. Mr. Beers, is there a provision in Section 550 that ad- 
dresses personnel hiring? 

Mr. Beers. I am not aware of it, sir. 

Mr. Waxman. Is there a provision that addresses use of travel 
cards or purchase cards? 

Mr. Beers. No, sir, I am not aware of that. 

Mr. Waxman. How about a provision that details how inspections 
are to be conducted? 

Mr. Beers. No, sir. 

Mr. Waxman. Is there a provision that explains how background 
checks should be conducted? 

Mr. Beers. No, sir. 

Mr. Waxman. Are there any enforceable deadlines in this law 
that are written in the appropriations bill? 

Mr. Beers. No, sir. 

Mr. Waxman. The answers to these questions are all no, and the 
reason is that this committee never held a hearing or conducted a 
markup on legislation to create this program. So the problems we 
see today were never contemplated by this committee, and no direc- 
tion was provided. Now I understand Mr. Barton said you ought to 
resign, but Mr. Barton was the chair of the committee at the time 
this law was adopted through an appropriations bill. We tried to 
get the people who have a stake in this to work out legislation, and 
the Democrats were in power and I was chairman. We had the 
chemical industry and others with us. When the Republicans came 
to power on this committee, they said let us just extend this for 7 
years. We will just kick this thing down the road for 7 years. 

Now, one of the proponents of doing that was the chemical indus- 
try. They were troubled by some of the ideas that we would have 
further inspections and we would have further deadlines and we 
would make sure that things happened, but while they participated 
with us in trying to change the law, they said all they wanted to 
do this last year was extend the existing law for 7 years. Now this 
existing law doesn’t have much of a requirement on you. 

You have established a working group, Mr. Beers, in the Depart- 
ment to look at legislative and regulatory changes and whether 
they are necessary, is that correct? Speak into the mic and be sure 
it is on. 
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Mr. Beers. I am sorry. Yes, sir, with respect to the entirety of 
the Department. 

Mr. Waxman. And the November report identified several statu- 
tory limitations on the program that limits effectiveness and in- 
cludes a rigid and limited enforcement authority. For example, a 
facility could violate requirements 20 times and they would — and 
you wouldn’t have the authority to take any more action based on 
repeat violations. That means that they can repeat these violations 
over and over again, and you couldn’t do anything about it. Is that 
right? 

Mr. Beers. Sir, that is an element of the report that we have 
looked into as a result of the report. While it is true that just on 
the face of it the answer to that is yes, we believe we could use 
our administrative order authority to have some action against 

Mr. Waxman. Excuse me, you are going to have to use your regu- 
latory authority to do something that should have been said in the 
law by Congress. I hope this working group will examine that. 

The report calls into question the adequacy of the program’s per- 
formance standards. That memo said “Without testing to evaluate 
the effectiveness of the performance standards, adequacy of the 
standard often is more a matter of opinion or fact.” Will your work- 
ing group give us some recommendations on that issue? 

Mr. Beers. Sir, as we come to recommendations, yes, we will 
give those to you. We, as you know, have to go through a very for- 
mal process. 

Mr. Waxman. Are you going to examine that issue, I presume? 

Mr. Beers. We will. 

Mr. Waxman. Well Congress should have examined it as well. 

So my point to you is, well, we are pointing fingers at you and 
you are saying you have excuses and everybody says we are going 
to do better. I think we all have a burden to bear in the failure, 
and Congress didn’t do its job and we hoped you would have taken 
up the slack and done the job that Congress should have directed 
you to do, but I think it is awfully premature for members of this 
committee to try to put the whole blame on you and say you ought 
to quit. Maybe some members of Congress ought to quit if we aren’t 
doing our job, or be replaced. 

I yield back my time. 

Mr. Shimkus. The gentleman’s time is expired. 

The chair now recognizes the gentleman from Colorado for 5 min- 
utes, and we are going to try to get this done and then adjourn the 
hearing after he is through. They did just call votes. 

Mr. Gardner. I thank the chairman for the recognition, and 
thank you as well to the witnesses for being here today. 

When I first read this memo, it was a little bit like Jerry 
McGuire meets the Titanic. You have got — just some of the words 
and phrases used in this memo: unnecessary expenses, unqualified 
personnel, unsuited for the work, problems with how money spent, 
foul language, ineffective hiring, unauthorized expenses, inappro- 
priate work behavior, catastrophic failure, perceived cronyism, fa- 
voritism. How would you grade your performance on a scale of 1 
to 100? 

Mr. Beers. I think this report is a clear indication that the pro- 
gram needs a whole lot of work on it, but I don’t think it entirely 
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recognizes what we have done, and I am not being an apologist, but 
I do think that it indicates that we have some major challenges 
which we are prepared to address. 

Mr. Gardner. Unauthorized use of money, problems with how 
money is spent, are criminal activities taking place here? 

Mr. Beers. Sir, those are issues that we are looking into. When 
we discovered them 

Mr. Gardner. You are looking into criminal — possible criminal 
activity? 

Mr. Beers. If that turns out to be the result of these reviews, 
the answer to that, of course, is yes. We have an obligation to you 
and to the American public to do that. 

Mr. Gardner. Do you — I mean, in terms of what you are facing, 
what else are we missing from this memo? I mean, is this a com- 
prehensive memo or are there other issues that you are finding, 
other issues that need to be addressed? 

Mr. Beers. Sir, you are asking me to say what the unknowns are 
here. I am not saying that this memo is the entirety, and I don’t 
think that David would say that. But it does represent a commit- 
ment to make sure that we understand the problems as we know 
them and to come up with solutions to fix that. David? 

Mr. Wulf. I would just add that I would echo the Under Sec- 
retary’s sentiments. I would say that the report was focused, you 
know, as it was intended to be, an internal candid assessment. It 
was focused very much on the challenges side of the equation. It 
did not focus as much on the program’s successes and opportuni- 
ties. You know, I would add, too, that we have a very talented and 
committed workforce within ISCD. We have very committed folks 
at both headquarters and in the field, all eager to move the pro- 
gram forward. And I think, as I mentioned earlier, you know, the 
problems we identified in the report are certainly not insignificant, 
but they are by no means insurmountable, and we are looking for- 
ward. We have a nearly 100 point action plan that is in progress. 
We are meeting on a weekly basis with Deputy Under Secretary 
Spalding to review progress on those items, and you know, we an- 
ticipate continued progress. 

Mr. Gardner. The report identifies several issues with the 
unionization, the challenges you faced with the union. Can you 
name any other agencies or offices who deal in anti-terrorism secu- 
rity, national security, who placed a union in the picture before 
most accountability measures were put in place? 

Mr. Wulf. I am not aware of any, but 

Mr. Gardner. OK. Let us talk a little bit about the budget. The 
memo talks on page 15, and I quote, “ISCD lacks a system for 
tracking the usage of consumable supplies, which creates an envi- 
ronment for fraud, waste, and abuse.” This isn’t an Inspector Gen- 
eral report, it is not the GAO saying this. It is the program man- 
agers describing their own program. So how can a member of Con- 
gress choose to fund a program that is so self-described? 

Mr. Wulf. We recognize some administrative shortcomings in 
the tracking of funds, and recognizing, too, that this is a relatively 
new program, relatively new organization, we have put into place 
safeguards relating to the receipt of goods. As I mentioned earlier, 
we didn’t identify actual fraud, waste, or abuse, just that there 
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were additional processes that needed to be put into place to en- 
sure that that does not 

Mr. Beers. And sir, a point of clarification here. That part of the 
report is actually taken from another review that was accomplished 
during, started before, and finished during the period in which they 
prepared that, and it was our own compliance unit that did that, 
that discovered that. They didn’t discover any charges to be laid, 
but they said that the procedures were inadequate, as the report 
correctly says. 

Mr. Gardner. Is there — DHS has an Inspector General, correct? 

Mr. Beers. We have an Inspector General and we have also — for 
the whole department, and we have an office of compliance and se- 
curity within our own NPPD, and that is who looked into this issue 
at the Assistant Secretary and my request. 

Mr. Gardner. So the Inspector General has looked into this? 

Mr. Beers. The Inspector General has access to these reports, 
yes, sir, but this was not done by 

Mr. Gardner. Have you had conversations with the Inspector 
General? 

Mr. Beers. With respect to this report? 

Mr. Gardner. Yes. 

Mr. Beers. I can’t speak to that. I have not personally had that 
conversation. 

Mr. Gardner. But he has this memorandum? 

Mr. Beers. As with all of these kinds of reports, yes, they are 
available. 

Mr. Gardner. They are available or he has them? I mean, have 
you sent it to him? 

Mr. Beers. I will have to confirm that to you, sir. 

Mr. Gardner. Thank you. And another question I would have, 
just based on the authorization, would a multi-year authorization 
give you the surety that you need to pursue programmatic improve- 
ments? Would it be helpful for you to be assured that legislatively 
the program can’t change? 

Mr. Beers. As the report says and as we have said for some 
time, a long-term authorization of this program is vital, both to the 
workforce and to our security partners and stakeholders in this 
program. It gives us a longer term stability that a year-to-year un- 
fortunately doesn’t provide us. 

Mr. Gardner. On the issue of re-tiering, there are a number of 
sites that were tiered last fall 

Mr. Shimkus. I would remind my colleague that we are getting 
close to the votes being already called. 

Mr. Gardner. I have some additional questions I will get over 
to you. I yield back my time. 

Mr. Shimkus. Gentleman yields back his time, and I appreciate 
that. 

Let me just say in follow-up, I think Mr. Beers testified he would 
like the law to have been made permanent at the last — at the 
March hearing, so — but let me also just again thank you, Mr. 
Beers, for your long career of public service. And this is a part of 
your portfolio, not your entire portfolio: Marine Corps officer in 
Vietnam, foreign service, obviously did stuff at the Department of 
State, Middle East, Persian Gulf, international narcotics and law 
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enforcement. We get caught up in the heat of battle. We expect you 
to address these issues and fix them, and that will make further 
hearings go well. 

And just in response to my friend, Mr. Waxman, I love his found- 
ing father quote, “Where good laws do well, good men do better.” 
So you can’t pass a law for total compliance. It is really the people 
that make things work, and I think you are going to get a handle 
on it. I just wish that the people who have left the Department did 
not get a move, but probably would have been held more account- 
able to their activities. 

With that, I would like to adjourn this hearing. Thank you for 
your service. 

Mr. Beers. Thank you. 

[Whereupon, at 11:17 a.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 
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Statement by Congressman G. K. Butterfield 
House Committee on Energy and Commerce 
Subcommittee on Environment and the Economy 
Evaluating Internal Operation and Implementation on the Chemical Facility Anti- 
Terrorism Standards (CFATS) program by the Department of Homeland Security 

February 2, 2012 

In 2006, the Appropriations Committee assigned the 
Department of Homeland Security (DHS) with the 
unprecedented task of securing chemical facilities 
across the nation from terrorist attacks. In the absence 
of regular order, the regulatory tools provided to DHS 
were vague and incomplete. Clearly, this has stifled 
the implementation of this crucial program. As the 
Chemical Facility Anti-Terrorism Standards (CFATS) 
program is set to expire in October, the Energy and 
Commerce Committee must be involved in the 
development of important and useful reforms. 
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The Committee on Energy and Commerce 
Internal Memorandum 


February I, 2012 

MEMORANDUM 

To: Members, Subcommittee on Environment and the Economy 

From: Committee Staff 

Subject: February 3, 2012, Hearing on Operation and Implementation of the 

Chemical Facility Anti-Terrorism Standards program (CFATS) 


On Friday, February 3, 2012, the Subcommittee on Environment and the Economy will 
hold an oversight hearing at 9:30 a.m. in room 2123 of the Rayburn House Office Building on 
implementation and operation of the CFATS program by the U.S. Department of Homeland 
Security (DHS). 

I. WITNESSES 

The Honorable Rand Beers 

Under Secretary for the National Protection and Programs Directorate (NPPD) 
Department of Homeland Security 

Penny J. Anderson 

Director, Infrastructure Security Compliance Division, Office of Infrastructure Protection 
Department of Homeland Security 

II. BACKGROUND 

Section 550 of Public Law 109-295 (Section 550) 

Section 550 provides the DHS statutory authority to regulate chemical facilities for anti- 
terrorism security purposes. Section 550 requires the Secretary of Homeland Security to issue 
interim final regulations establishing risk-based performance standards for chemical facility 
security, as well as the development of vulnerability assessments and the development and 
implementation of site security plans by covered facilities. These regulations apply only to those 
facilities with chemicals that the DHS Secretary determines present high levels of security risk. 

Department of Homeland Security Regulations Implementing Section 550 

The Department of Homeland Security issued an “interim final rule” regarding chemical 
facility security in April 9, 2007, that took effect on June 8, 2007, Under it, facilities with 
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certain chemicals must perform a “top screen” (i.e., initial assessment of potential facility 
vulnerabilities) and submit this information to DHS so that DHS can determine if a facility's risk 
status merits further coverage under CFATS. High-risk facilities are then categorized into four 
risk-based tiers. DHS established different performance-based requirements for facilities 
assigned to each risk-based tier with high-risk facilities engendering additional responsibilities 
including (1) vulnerability assessment development, (2) site security plan formation and 
submittal, and (3) required implementation of the security plan. High-risk facilities may develop 
vulnerability assessments and Site Security Plans (SSPs) using alternative security programs so 
long as they meet the tiered, performance-based requirements of the interim final rule. The 
Secretary may disapprove submitted vulnerability assessments or site security plans that fail to 
meet DHS standards but not on the basis of the presence or absence of a specific measure. In the 
case of disapproval, DHS will identify areas of the assessment and plan that need improvement. 

Implementation 

At the outset of the program, DHS expected that roughly 30,000 facilities would be 
required to comply with the reporting requirements of the regulations, with only 6,000 falling 
into one of the four (4) high-risk categories requiring further regulation. 

On March 3 1 , 201 1, DHS Undersecretary of NPPD, Rand Beers, testified before the 
Subcommittee on Environment and the Economy that CFATS covered 4,744 high-risk facilities 
nationwide and that 4,126 facilities had received final high-risk determinations. In addition, Mr. 
Beers stated that while more than 4,100 facilities have submitted Site Security Plans (or Alternative 
Security Programs) to date - and DHS was in the process of reviewing these submissions, DHS was 
still issuing final tier notifications to facilities across all four risk tiers. 

In addition, Mr. Beers testified that more than 39,000 facilities had registered with DHS 
and completed the top-screen process. Of these facilities, DHS considered more than 8,064 as 
high risk and required them to submit a site vulnerability assessment. 

Also, Undersecretary Beers testified that DHS was in the process of filling all its 
positions for chemical facility security officers and inspectors and that DHS planned to continue 
to hire throughout the fiscal year. He stated, too, that DHS has a total of 1 88 people either hired 
or in the process of on-boarding. In addition, DHS has hired 97 of 103 field inspector positions 
and all of 14 field leadership positions. Mr. Beers further testified that DHS began “inspections” 
of Tier 1 facilities in February 2010, had completed approximately 175 “pre-authorization 
inspections” and 350 “compliance assistance visits, and had completed four “authorization” 
inspections. Facilities that have successfully implemented their approved SSPs and have passed 
an inspection are in compliance. 

Improper Tiering and Delayed Notification under CFATS 

To determine if a facility is to be regulated as high risk and, if so, which tier it falls into, 
DHS uses a computer system that assesses risk based upon potential worst-case scenarios for a 
particular facility. On July 21, 201 1, DHS officials informed Committee staff that in May 2010, 
CFATS program officials realized they had used improper inputs and modeling in the computer 
assessments for the formal tiering process, resulting in improper tiering of 600 facilities between 
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the end of 2009 and spring 2010. In addition, DHS officials made clear that CFATS officials at 
that time consciously chose to not tell anyone about it. After personnel changes for the CFATS 
program, an internal investigation in Summer 201 1 led to notifications of those facilities that had 
received a corrected CFATS risk tier as a result of a June 27, 2011, re-tiering process. 
Specifically, 148 facilities were tiered at a lower risk tier, 99 facilities were found not to need a 
tier and no longer became subject to CFATS regulation, 41 facilities have either data errors that 
still need correction or have their redetermination under review, and 1 75 facilities remain in the 
same level but will have the risk levels for their chemicals of interest decrease. Total overall 
numbers, per DHS, as of January 30, 2012 are: 


Tier Level 

# of Facilities 
Before Error 

# of Facilities 
Assigned to Tier 
After Correction 

# of Facilities to 
Change Tier 

# of Facilities 
Awaiting Final 
Tier 

i 

216 

115 

101 

7 

2 

538 

456 

82 

51 

3 

1,129 

1,081 

48 

175 

4 

2,243 

2,050 

193 

537 


DHS Internal Memorandum on CFATS 

Following the “mis-tiering” episode, the new Director of Infrastructure Security 
Compliance Division, Penny J. Anderson, and her Deputy Director, David M. Wulf, conducted 
an internal review of the entire CFATS and Ammonium Nitrate programs at DHS, summarizing 
their findings in a November 10, 201 1, memorandum to Undersecretary Rand Beers and 
Assistant Secretary David Keil. Fox News ran a print story about the contents of the report on 
December 21, 201 1.' 

The report identifies five (5) main programmatic challenges for the CFATS program: 
inadequate training capability, an overreliance on hired consultants for expertise, inappropriate 
transitions for new hires, uncertainty from extremely short program authorizations, and issues 
regarding job descriptions and the presence of an employee union. It also lists nine (9) staffing 
challenges for the CFATS program, including inexperienced managers, personnel placed in jobs 
for which they are not qualified, inadequate internal staff control, and lack of regulatory 
compliance expertise. Following the internal memorandum, the Department prepared a list of 
recommendations for correcting the troubles plaguing the program. It identifies the highest 
program priorities: speeding up the SSP review process, preparing for compliance inspections, 
and development and implementation of a personnel surety program for CFATS. The only 
legislative recommendation made in the report was a long-term extension of the existing 
program. 

On January 30, 2012, the Department provided the Committee with the November 10, 
201 1, Anderson memorandum, together with additional attachments. The document is labeled 
“For Official Use Only.” Members who wish to study the Anderson memorandum prior to the 
February 3, 2012, hearing may obtain a copy from room 2125 Rayburn House Office Building. 


1 http://www.foxnews.com/poiitics/201 1/12/21/exclusive-beset-by-strife-at-dhs-office-fiiture-anti-terrorism- 
program-now- in/ 
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III. Staff Contacts 

If you have any questions regarding this hearing, please contact Dave McCarthy 
( dave.mccarthv@mail.house.gov1 of the Majority Committee staff at (202) 225-2927, 


* :jc % af: jjc 


DHS Funding for Chemical Facility Security Regulation by Fiscal Year (in millions) 


Request Appropriation Full-time 

Fiscal Year ($ in millions) ($ in millions) Equivalents 


FY2007 

10 

22 

0 

FY2008 

25 

50 

21 

FY2009 

63 

78 

78 

FY2010 

103 

103 

246 

FY2011 

105 

96 

257 

FY2012 

99 

93 

242 


Source: Department of Homeland Security, Preparedness Directorate, Infrastructure Protection 
and Information Security, FY2007 Congressional Justification', Department of Homeland 
Security, National Protection and Programs Directorate. Infrastructure Protection and 
Information Security, Fiscal Year 2008 Congressional Justification', Department of Homeland 
Security, National Protection and Programs Directorate, Infrastructure Protection and 
Information Security, Fiscal Year 2009 Congressional Justification', Department of Homeland 
Security, National Protection and Programs Directorate, Infrastructure Protection and 
Information Security, Fiscal Year 2010 Congressional Justification; Department of Homeland 
Security, National Protection and Programs Directorate, Infrastructure Protection and 
Information Security, Fiscal Year 2011 Overview Congressional Justification; Department of 
Homeland Security, National Protection and Programs Directorate, Infrastructure Protection and 
Information Security, Fiscal Year 2012 Congressional Justification; H.Rent. 109-699 : P.L. 1 10- 
28; the explanatory statement for P.L, 110-161 at Congressional Record, December 1 7, 2007, p. 
H 1 6092; the explanatory statement for P.L, 1 10-329 at Congressional Record, September 24, 
2008, pp. H9806-H9807; H.Rept, 1 1 1-298 : P.L. 111-242 . as amended; S.Rept. 112-74 : and 
H.Rent. 1 12-331 . 
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FRED UPTON, MICHIGAN HENRY A. WAXMAN, CALIFORNIA 

CHAIRMAN RANKING MEMBER 

ONE HUNDRED TWELFTH CONGRESS 

Congress of tfje Uniteb States 

goiis'e ot ^epresentattbES 
COMMITTEE ON ENERGY AND COMMERCE 
2125 Rayburn House Office Building 
Washington, DC 20515-6115 

Majority (202) 225-2927 
Minority (202) 225-3641 


February 21, 2012 


The Honorable Rand Beers 
Under Secretary 

National Protection and Programs Directorate 
U.S. Department of Homeland Security 
Washington, D.C. 20528 

Dear Under Secretary Beers: 

Thank you for appearing before the Subcommittee on Environment and the Economy on February 3, 
2012, to testily at the hearing entitled “Evaluating Internal Operation and Implementation of the Chemical 
Facility Anti-Terrorism Standards program (CFATS) by the Department of Homeland Security.” 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains open for 
1 0 business days to permit Members to submit additional questions to witnesses, which are attached. The 
format of your responses to these questions should be as follows: (1) the name of the Member whose question 
you are addressing, (2) the complete text of the question you are addressing in bold, and then (3) your answer to 
that question in plain text. 

To facilitate the printing of the hearing record, please e-mail your responses, in Word or PDF format, to 
Aiex.Yergin@mail.hotise.gov by the close of business on Tuesday, March 6, 2012. 

Thank you again for your time and effort preparing and delivering testimony before the Subcommittee. 


Sipcerely, 



/ohn Shimkuir 
Chairman 

Subcommittee on Environment and the Economy 


cc: The Honorable Gene Green, Ranking Member, 

Subcommittee on Environment and the Economy 


Attachment 
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Question#: 

i 

Topic: 

issues 

Hearing: 

Evaluating Internal Operation and Implementation of the Chemical Facility Anti- 
Terrorism Standards program (CFATS) by the Department of Homeland Security 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: At the March 31, 20 i 1 hearing, I asked you if there were any implementation 
issues that need clarifying. You mentioned only issues related to personnel surety and 
agricultural facilities. Clearly, the Anderson/Wulf memo suggests that these were only a 
tiny tip of the iceberg. 

When were you made aware that more than two implementation issues were facing 
CFATS? 

Response: The broader issues began to more clearly emerge in June 201 1 when 1 was 
notified about the F 1 Tiering issues. Although Assistant Secretary Keil and I, as a matter 
of due diligence, asked the National Protection and Program Directorate's Office of 
Compliance and Security to conduct a management review in December 2010, the results 
were not available until September 2011. 
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Question#: 

2 

Topic: 

priorities 

Hearing: 

Evaluating Internal Operation and Implementation of the Chemical Facility Anti- 
Terrorism Standards program (CFATS) by the Department of Homeland Security 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Do you agree with Mr. Wulf s testimony that the Site Security Plan Review 
Process and preparing for compliance inspections are the two highest program priorities? 

Are those priorities higher than fundamental government management controls? 

Response: Yes, the Site Security Plan (SSP) Review Process and preparing for, and 
ultimately conducting, compliance inspections are the two highest programmatic 
priorities. Of course, proper program management and fundamental government 
management controls are essential to the success of any government program, including 
the successful achievement of the SSP review and compliance inspection priorities. As 
discussed with this Committee, we are addressing certain programmatic and management 
challenges through a comprehensive Action Plan. The National Protection and Programs 
Directorate’s senior leadership is briefed on a regular basis on the progress made to 
address the nearly 100 items contained in the Action Plan. The Department looks 
forward to continuing to make progress on the Action Plan and working with Congress to 
ensure continued success in the CFATS program. 
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Question#: 

3 

Topic: 

ISCD 

Hearing: 

Evaluating Internal Operation and Implementation of the Chemical Facility Anti- 
Terrorism Standards program (CFATS) by the Departme nt of Homeland Security 

Primary: 

The Honorable John M, Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: ISCD does not appear to have an adequate level of confidence in its expertise 
to approve site security plans. If DHS/ISCD begins to rapidly approve SSPs, or for that 
matter rapidly disapprove them, why should Congress have confidence that these 
decisions are well informed and reflect sound, expert judgment? 

Response: Infrastructure Security Compliance Division (ISCD) staff possess the 
expertise to review and recommend authorization and approval or disapprove Site 
Security Plans (SSP). These recommendations are well-informed and reflect sound, 
expert judgment. Resident scientists and engineers at the Department of Homeland 
Security’s (DHS) Science and Technology Directorate Chemical Security Analysis 
Center are also available to provide subject matter expertise, as appropriate. 

After a facility’s SSP is authorized or conditionally authorized, an authorization 
inspection is scheduled. Authorization inspections are conducted at covered facilities in 
order to verify that the descriptions of current and planned measures listed in the 
facility’s security plan are accurate and complete. If, in reviewing/evaluating the results 
of the authorization inspection and other information, it is determined that the security 
plan is sufficient, DHS then approves the SSP and the facility is notified that it should 
carry through with the planned measures and should continue to implement existing 
measures. 

To date, ISCD staff have authorized or conditionally authorized SSPs for 60 Tier 1 
facilities. DHS has not yet approved any facility’s SSP. ISCD will continue to review 
and as appropriate, authorize, Tier 1 SSPs and will work with facilities that have not yet 
received authorizations to improve their ability to meet the risk-based performance 
standards. NPPD and ISCD leadership also expect that as additional processes, guidance, 
training, and tools are developed to assist staff in the SSP review process and as 
additional experience is gained in the conduct of SSP review's, the pace of the SSP 
reviews will increase while maintaining the quality of the review process and of the 
decisions made. 
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Question#: 

4 

Topic: 

Tier ! 

Hearing: 

Evaluating Internal Operation and Implementation of the Chemical Facility Anti- 
Terrorism Standards program (CFATS) by the Department of Homeland Security 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: What quality control measures do you have in place for implementation of 
Tier 1 Site Security Plan reviews? How will these review standards be different from the 
long-term review process? 

Response: The Infrastructure Security Compliance Division (1SCD) has established an 
interim Site Security Plan (SSP) review process that includes the development, 
refinement, and training in definitions and review procedures; a multi-layered review 
approach that still allows for expeditious review and that ensures consistency in 
application of standards; and a quality assurance procedure for reviewing and reporting 
on the effectiveness, efficiency, and consistency of reviews. 


1SCD is in the process of further refining a long-term review process and will incorporate 
lessons learned from the interim review process. 
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Question: Do the personnel matters identified in the report help explain the failure to 
approve the site security plans? 

Response: A variety of factors, including some of the personnel issues identified in the 
Infrastructure Security Compliance Division (ISCD) memorandum, have contributed, to 
some degree, to challenges related to the review of Site Security Plans (SSP), although 
much progress has been made in recent months. As described in the proposed ISCD 
Action Plan accompanying that memorandum, the Department of Homeland Security 
(DBS) is addressing these challenges in a conscientious manner, and the pace of SSP 
review and authorization has already improved since the memorandum was completed. 

Question: Are there any portions of the SSP review and compliance inspection process 
that DBS must bargain over with the inspectors union? 

Response: On March 16, 2011, the Federal Labor Relations Authority (FLRA) certified 
the American Federation of Government Employees Local 9 1 8, as the exclusive 
representative for all eligible ISCD Inspection and Enforcement Branch (I&EB) 
employees. 

As a result of the FLRA’s certification, ISCD is obligated to comply with Chapter 71 of 
Title 5 of the United States Code, Executive Order 1 5322, and the Master Agreement 
between National Protection and Programs Directorate and American Federation of 
Government Employees Local 918, Agreement 201 1 in labor relations issues impacting 
the working conditions of I&EB employees in the bargaining unit. 

ISCD is in the process of further developing a long-term SSP review process, as well as 
potential updates to compliance inspection procedures. Any collective bargaining 
obligations will be assessed when the above-referenced potential revisions to the SSP 
review process and the compliance inspection procedures are further developed. 

Question: In your opinion how many DHS personnel are well-qualified to review and 
approve or disapprove Site Security Plans? 

Response: Review and approval, or disapproval, of an SSP typically requires skills in 
multiple disciplines, such as physical security, cybersecurity, chemistry, and engineering. 
Accordingly, review of an SSP cannot be performed by any single individual. Rather, an 
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SSP review requires the collaboration of a team of qualified experts. ISCD has a number 
of employees in each of the skill sets required to review SSPs w'ho are well qualified to 
conduct that review in a consistent, efficient manner and to make appropriate 
recommendations to senior leadership, enabling them to make reasoned decisions as to 
SSP approval or disapproval. The current interim SSP review process, although 
resource-intensive, has proven in a very short time that teams of ISCD personnel are well 
qualified to conduct these reviews with appropriate guidance and training. 
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Question : On March 3 1 , 20 1 0, you testified that “our analysis indicates that this 
[CFATS] program is delivering tangible results that make our Nation more secure.” 
Further you said: “successful security gains have already been implemented as a result.” 

Besides the voluntary removal of chemicals from various facilities, what other security 
gains have DHS (as opposed to facility operators) accomplished? 

Response: The Chemical Facility Anti-Terrorism Standards (CFATS) program has 
significantly reduced, directly or indirectly, the overall security risk associated with the 
chemical sector in several ways: 

• Development of a list of chemicals of interest (COI) with screening threshold 
quantities (STQ), as specified in Appendix A to CFATS, which the Department of 
Homeland Security (DHS) uses to help identify potentially high-risk chemical 
facilities with minimal burden on the chemical industry. Without this COI list, it is 
unlikely that many of the more than 2.300 facilities that have voluntarily removed or 
significantly reduced the onsite quantity of C'Ol related to their potential security risks 
would have done so. 

• Development of an easy-to-use, online assessment tool (the “Top-Screen”) through 
which potentially high-risk chemical facilities possessing COI at or above the 
applicable STQ submit information to the Department to facilitate preliminary 
identification of facilities presenting a high security risk. 

• Review of more than 40.000 Top-Screen submissions, resulting in the initial 
identification of more than 7,000 preliminary high-risk facilities. 

• Development of an online Security Vulnerability Assessment (SVA) tool, through 
which preliminary high-risk facilities have provided the Department with additional, 
more-detailed information about their chemicals, their specific circumstances and 
their potential vulnerabilities, which DHS uses to make a final determination 
regarding the facilities’ risk status. 

• Completion of the review to date of more than 6,500 SVAs, resulting in the issuance 
of final high-risk determinations for more than 3,700 facilities and assignment of 
those facilities to appropriate risk-based tiers. 

• Development of an online Site Security Plan (SSP) tool for use by final high-risk 
chemical facilities in the development and submission of SSPs or Alternative Security 
Programs (ASPs) for DBS’s review and approval or disapproval. This SSP tool 
collects information on how each facility will meet the applicable risk -based 
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performance standards (RBPSs) under CFATS. The tool is designed to take into 
account the complicated nature of chemical-facility security and allows facilities to 
describe both facility-wide and asset-specific security measures. This tool has helped 
facilities make appropriate and sound decisions in developing security plans that fit 
the unique characteristics of each facility and best account for the facility’s assets and 
vulnerabilities. 

• Publications of a RBPS Guidance document to assist CFATS-covered facilities 
develop adequate SSPs. The RBPS Guidance document provides guidance on what 
types and combinations of security measures and processes may be appropriate for a 
facility, based on its unique circumstances, and addresses specific items a facility may 
wish to consider when selecting security measures and procedures (such as physical 
and environmental considerations, command and control considerations, and the use 
of layered security) to satisfy the RBPS. This document can also be of value to 
facilities not regulated under CFATS since it provides guidance on effective security 
measures that such unregulated facilities could implement voluntarily. 

• Enhancement of the national ability to prepare for and respond to potential threats 
directed at or involving aspects of many types of chemical facilities (including 
facilities not traditionally considered part of the chemical industry), based on the 
information provided through Top-Screen and SVA submissions. This has 
contributed greatly to the development of a more comprehensive, nationwide picture 
of chemical security risks and concerns. CFATS and the data the Department has 
collected have given the Federal Government a far better understanding of what 
dangerous chemicals are available commercially, who has them, how they are 
handled and secured, as well as which facilities present the highest risks. 

• Establishment of a sensitive but unclassified information-protection regime, called 
Chemical-terrorism Vulnerability Information (CVI), to help protect certain sensitive 
security information developed and/or provided to the Department in compliance with 
CFATS. 

• Completion of more than 1 ,000 Compliance Assistance Visits as of February 27, 

2012, and participation in more than 3,000 informal introductory meetings with 
owners and/or operators of CFATS-regulated facilities, which have helped to ensure 
that the regulated community is aware of CFATS requirements, and of chemical 
security risks. 

• Development of working relationships with state and local officials through outreach 
efforts beyond the regulated community. Those relationships are enhancing the 
overall level of preparedness of the nation for preventing or responding to potential 
terrorist attacks involving high-risk chemical facilities or chemicals from those 
facilities and will pay positive dividends in the event of a chemical security incident. 
To this end, the Infrastructure Security Compliance Division (1SCD) has participated 
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in more than 2,500 meetings involving Federal, state, and local partners, including 
more than 1 00 Local Emergency Planning Committee meetings. 

• Increase in security awareness and education through outreach activities, as well as 
the CFATS website and Help Desk. 

• Establishment of an anonymous CFATS Tip-Line, which supports the reporting of 
suspicious activities and the identification of facilities or individuals who potentially 
are not complying with CFATS requirements. 

• Collaboration within DHS and with other Federal agencies in the area of chemical 
security, including routine engagement among the National Protection and Programs 
Directorate’s subcomponents and with the U.S. Coast Guard; the Transportation 
Security Administration; the Department of Justice's Federal Bureau of Investigation; 
and Bureau of Alcohol, Tobacco, Firearms and Explosives, the Nuclear Regulatory 
Commission, and the Environmental Protection Agency. This collaboration allows 
for the identification of potential security gaps and the sharing of lessons learned, all 
of which makes the overall homeland security effort more efficient and effective. 

As the above activities demonstrate, CFATS has helped the nation better understand the 
complex security issues associated with the chemical industry, allowed the Federal 
Government to identify high-risk chemical facilities throughout the nation, provided tools 
to allow high-risk facilities to assess their vulnerabilities and develop plans to reduce 
their risks, spurred the voluntary elimination or reduction of chemicals of interest at 
facilities throughout the country, facilitated the selection and implementation of security 
measures and procedures to reduce security risks, and enhanced nationwide-preparedness 
through increased understanding and collaboration. 




64 


Question#: 

7 

Topic: 

inspection 1 

Hearing: 

Evaluating Internal Operation and Implementation of the Chemical Faci lity Anti- 
Terrorism Standards program (CFATS) by the Department of Homeland Security 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: On October 1 , 2009, testifying with you on behalf of the Department Sue 
Armstrong stated that formal inspections would begin in December 2009. According to 
the internal memo, compliance inspections have still not occurred. 

Is it correct that compliance inspections have not yet occurred? 

Response: Correct, compliance inspections have not yet occurred because the 
Department of Homeland Security (DHS) has not yet approved any Site Security Plans 
(SSP) or Alternative Security Programs (ASP). 

Question: Is it also correct that the “inspections” you have conducted do not measure 
actual compliance with the standards? 

Response: The Infrastructure Security Compliance Division (ISCD) has conducted 10 
authorization inspections to date. These inspections are conducted following ISCD’s 
issuance of a Letter of Authorization for a high-risk facility’s SSP in order to verify that 
the descriptions in the facility’s authorized SSP or ASP are accurate and complete and 
that the equipment, processes, and procedures described are appropriate and sufficient to 
meet applicable CFATS performance standards. The findings from an authorization 
inspection, as well as other relevant available information, are evaluated by ISCD to 
determine whether or not DHS should issue a Letter of Approval for an SSP or ASP. An 
authorization inspection differs from a compliance inspection in that the latter is used to 
evaluate a facility’s compliance with an SSP or ASP that DHS has approved. 

Question: Do we know, today, that sites comply with standards? 

Response: ISCD is currently evaluating whether covered facilities’ SSPs meet applicable 
Risk-Based Performance Standards (RBPS) through (a) the SSP review process and (b) 
the authorization inspection process at facilities that have already received Letters of 
Authorization for their SSPs. Compliance inspections cannot be conducted to verify 
facilities’ compliance with their SSPs, however, until DHS has approved the SSPs. 
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Question: What specifically did you understand Ms. Armstrong to mean on October 1, 
2009? 


Response: We understand that she was estimating that authorization inspections would 
begin on or around December 2009, based on information and projections available at 
that time. The first authorization inspection took place in July 2010. 

Question: What, in your judgment, led to the inspection gap between October 2009 and 
November 2011? 

Response: ISCD assumes the term '‘inspection gap” refers to the fact that ISCD has 
conducted 10 authorization inspections to date. Authorization inspections occur after a 
facility’s SSP receives a Letter of Authorization. ISCD has worked to overcome the 
challenges it faces in evaluating SSP submissions and issuing Letters of Authorization. 
The interim SSP review process that ISCD established has enabled it to more than 
quadruple the number of SSPs that have received Letters of Authorization (a total of 60 
as of March 2012). ISCD conducted the first authorization inspection in July 2010, has 
already conducted 10 authorization inspections and plans to begin conducting 
authorization inspections at the remaining facilities that have received Letters of 
Authorization beginning in the fourth quarter of fiscal year 2012. 
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Question: The Anderson/Wulf memo of November 201 1 states: “we are not ready to 
conduct a compliance inspection. To date, we have not determined the content or design 
of a compliance inspection, nor have we developed the necessary processes and 
procedures to conduct a compliance inspection.” 

So what types of inspections have been occurring? 

Is it correct that compliance inspections may turn up results that differ from the less- 
formal “assistance” inspections that have been conducted? 

Response: Compliance inspections are conducted after a covered facility’s Site Security 
Plan (SSP) or Alternative Security Program (ASP) has been approved by the Department 
of Homeland Security (DHS). Since no SSPs or ASPs have yet been approved, the 
Infrastructure Security Compliance Division (ISCD) has not yet conducted any 
compliance inspections. 

Authorization inspections occur after a covered facility receives a Letter of Authorization 
for its SSP or ASP. Authorization inspections are conducted by ISCD inspectors in order 
to verify that the descriptions of measures in the facility’s authorized SSP or ASP are 
accurate and complete, and that the equipment, processes, and procedures described in 
the SSP or ASP appear to be appropriate to meet applicable Chemical Facility Anti- 
Terrorism Standards (CFATS) risk-based performance standards. The authorization 
inspection results, as well as other relevant available information, are evaluated by ISCD 
to determine whether or not DHS should issue a Letter of Approval for the facility’s SSP. 
To date, ISCD has completed 10 authorization inspections. 

CFATS inspectors have also conducted and may continue to conduct w'hat have been 
previously referred to as Preliminary Authorization Inspections (PAIs), which are visits 
to CFATS covered facilities that have submitted SSPs but that have not yet received 
Letters of Authorization for their SSPs. To avoid confusion with CFATS authorization 
inspections and compliance inspections, ISCD now refers to these inspector activities as 
Compliance Assistance Visits. The main purposes of those pre-authorization visits are to 
help ISCD gain a better understanding of the processes, risks, vulnerabilities, response 
capabilities, security measures and practices, and other factors at a covered facility that 
are relevant to ISCD’s review of the facility's SSP and to help facilities more fully 
develop and explain the security measures in their SSPs. 
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Because of the different purposes of compliance inspections and what were previously 
called PAIs, it is possible that the results of inspection visits could differ. 
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Question: You have indicated that DHS has “on board” 123 FTEs in inspection and 
enforcement, yet, as of the November 201 1 Anderson/Wulf Memo, you “have not 
determined what a compliance inspection will look like or how it will be conducted, nor 
have we trained the inspectors how to engage in compliance activities”. 

What do these inspectors do and why were they hired before the development and 
understanding, both by DHS/1SCD and the inspectors, of their duties? 

Have you made progress correcting these deficiencies since December 2011? 

What is the status of their training? 

Response: As of February 27, 2012, the inspectors have completed 10 authorization 
inspections at high-risk chemical facilities with authorized or conditionally authorized 
Site Security Plans (SSP), 1 80 Pre-Authorization Inspections (now referred to as 
Compliance Assistance Visits), more than 1,000 other Compliance Assistance Visits to 
covered facilities, almost 700 presentations to Federal, state, local and private sector 
partners, and more than 3,000 outreach visits to the potentially regulated community. 
Additionally, the inspectors have attended more than 2,500 meetings with Federal, state 
and local partners. 

In the preliminary stages of implementing the Chemical Facility Anti-Terrorism 
Standards (CFATS) regulation, the inspectors have focused much of their efforts on 
providing outreach and on assisting chemical facilities in understanding the requirements 
of this developing program. This was especially important in the first few years after the 
Department of Homeland Security (DHS) adopted the CFATS regulations, since many, if 
not most, of the potentially affected facilities had no prior experience with federal 
security regulatory programs. In particular, inspectors provided information to and 
assisted many facilities in registering to use the online Chemical Security Assessment 
Tool (CSAT), understanding how to use and complete the CSAT Top Screen and 
Security Vulnerability Assessment (SVA) tools, and in understanding how to prepare and 
submit (or revise) SSPs or Alternative Security Programs (ASPs). These outreach and 
assistance efforts were and are essential to the effective implementation of the CFATS 
program. In fact, the assistance provided by the inspectors has contributed substantially 
to the submissions by chemical facilities to date of more than 40,000 Top Screens, more 
than 6,500 SVAs and more than 4,200 SSPs. 
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The Infrastructure Security Compliance Division (ISCD) stood up a working group in 
September 20 1 1 to review the current processes, procedures, and equipment utilized by 
the inspector cadre and to update or develop additional materials and tools to further 
assist the inspector cadre in performing future authorization inspections as well as 
compliance inspections, which occur after approval of SSPs or ASPs. ISCD plans to 
finalize updates to the inspection procedures and to provide additional training to the 
inspector cadre later in fiscal year 20 12. 
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Question: When will we see operations of this compliance inspection program? 

Response: Though the Infrastructure Security Compliance Division (1SCD) has yet to 
begin performing compliance inspections, the inspectors are engaged in other operational 
activities on a day to day basis. 

ISCD will utilize compliance inspections on a periodic and as-needed basis to verify that 
facilities with approved Site Security Plans (SSP) or Alternative Security Programs 
(ASP) are complying with their approved SSPs or ASPs. 

ISCD stood up a working group in September 201 1 to review the current processes, 
procedures, and equipment utilized by ISCD's inspectors and to update/develop 
additional materials and tools for the inspectors to accomplish all types of Chemical 
Facility Anti-Terrorism Standards (CFATS) inspections, including authorization 
inspections, which occur before approval of an SSP. as well as compliance inspections. 
Based on the work of this group, ISCD plans to finalize updates to the internal inspection 
procedures later in fiscal year (FY) 2012. ISCD also plans to provide additional training 
to its inspector cadre, which will enable them to continue authorization inspections at 
Tier 1 facilities in FY 2012. After the authorization inspections for Tier 1 facilities are 
completed, ISCD's next priority will be authorization inspections of Tier 2 facilities. 

Compliance inspections will occur on a prioritized basis, beginning with Tier 1 facilities, 
after facilities have been issued Letters of Approval. Since this is dependent on the 
findings of the authorization inspections and ISCD’s further review of the SSPs prior to 
approval, ISCD is not able at this time to provide a timeframe for when compliance 
inspections will begin. 

Question: When was the Infrastructure Security Compliance Division at DHS 
operational? 

Response: The following timeline highlights ISCD’s steps towards becoming 
operational: 

• October 2006 - Section 550 of the Department of Homeland Security (DHS) 
Appropriations Act of 2007, Public Law 109-295, was enacted. The Office of 
Infrastructure Protection established the Chemical Security Working Group 
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(CSWG) to work with DHS Office of the General Counsel to develop regulations 
implementing Section 550, 

• December 2006 - DHS released the Advance Notice of Rulemaking. 

• Spring 2007 - The Chemical Security Compliance Division (CSCD) was formed. 

• April 2007 - DHS published the CFATS interim Final Rule. 

• Fall of 2007 - CSCD’s name was changed to ISCD. 

• November 2007 - DHS published Appendix A to the CFATS Interim Final Rule. 

• January 2008 - Facilities began submitting Top-Screens for ISCD review prior to 
preliminary identification of high-risk facilities. 

Question: When did you begin hiring potential inspectors and related staff for 
implementing the CFATS? 

Response: The CSWG was established in October 2006 with limited personnel. CSWG 
obtained detailees from the Federal Protective Service in November 2006 to perform 
duties relating to Sec. 550. Many of these detailees later became CSCD, and then ISCD 
inspectors. ISCD did not begin to directly hire inspectors until July 2008. 
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Question: The Anderson/Wulf Memo mentions that the CFATS office has not developed 
a process for the integration of new hires. Yet, the memo also clearly states that the 
CFATS workforce is top-heavy and has folks employed whose skills should not qualify 
them for these jobs. 

Should the CFATS workforce be culled to make sure you have the best fit between 
workforce and mission? 

Flow long do you expect to have a hiring freeze while ISCD develops a plan to hire 
specific skill sets and properly integrate new employees? 

Response: The Infrastructure Security Compliance Division’s (ISCD) Director and 
Deputy Director are leading an internal analysis to determine the proper staffing needs of 
the Division and ensure that the Chemical Facility Anti-Terrorism Standards (CFATS) 
workforce is qualified to meet those needs. While hiring actions will not be taken until 
confirmed needs are identified, the skills required to fill those needs are defined, and a 
plan is in place to properly integrate the selected employees. ISCD is not implementing a 
“hiring freeze” and will take appropriate actions to fill vacancies and other staffing needs 
as the criteria above are met. 
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Question: The Anderson/Wulf Memo is critical of administrative restrictions on hiring. 

It says NPPD advised the CFATS program that its policy prevented hiring trainers and 
people with appropriate skill sets. 

What NPPD policy is that? is it statutory in nature or administrative? Is something being 
done to correct it? 

Response: There is no statute, regulation, or National Protection and Programs 
Directorate (NPPD) policy preventing the hiring of training personnel or people with the 
appropriate skill sets for their approved positions. However, it was originally envisioned 
that certain positions, such as those related to training, would be staffed at the 
Department of Homeland Security (DHS)-level rather than at the Office of Infrastructure 
Protection (IP)-level. 

Question: Was the mass hiring of 0343 personnel, or general analysts, related to the 
NPPD policy? If not, what was the reason? 

Response: No, the hiring of the General Series-0343 Management and Program Analysts 
was not related to NPPD policy. This was an initiative to recruit for and fill numerous 
vacant positions across IP, not just the Infrastructure Security Compliance Division 
(1SCD). 

Question: Is the prohibition on hiring 1 700 series training personnel related to the NPPD 

policy? 


Response: Currently there is no prohibition against hiring training personnel within the 
1 700 series. NPPD subcomponents are responsible for addressing their own technical 
and specialized training requirements; however, they are expected to work in conjunction 
with the training experts within the NPPD Office of Professional Development and 
Training. Once the major duties for a position are identified, classification standards are 
used to determine the appropriate title, series, and grade level. 

It is NPPD's understanding that Subcomponents were not previously permitted to hire 
1 700 series personnel due to plans to staff this function at the DHS level and that these 
plans are no longer actively being pursued. 
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Question: What does the Department plan to do with the '‘several” inspector training 
courses that have little to do with inspections or enforcement? 

Response: ISCD is conducting a comprehensive review of the curriculum from the 
training courses ISCD previously provided to its Inspectors. This redesign will result in a 
more focused and streamlined Inspector training curriculum and includes the elimination 
of any courses and material that ISCD determines are no longer necessary and the 
development of additional, relevant curricula. 
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Question: The Anderson/Wult'Memo is highly critical of the lack of qualified, 
permanent supervisors. It states that many CFATS employees have been allowed to 
violate policy and underperform without consequences. 

What is the process for becoming a supervisor? 

Response: Employees may apply to vacancy announcements for supervisory positions 
through the Office of Personnel Management’s (OPM) USAJobs website. The 
candidates are evaluated by answering assessment questions; the applications are 
reviewed by OPM; and qualified candidates are referred to the selecting official. 

Question: Does DHS have specific criteria that are prerequisites to becoming a 
supervisor? 

Response: Yes. If an employee applies for a supervisory position he or she will be 
required to answer assessment questions. Management also has the right to reassign 
current employees into supervisory positions if they determine the employee is qualified 
and possesses the necessary skill sets for the position. Additionally, new supervisors are 
required to complete a one-year supervisory probationary period. The Department of 
Homeland Security (DHS) has training requirements for new supervisors to the 
Department and is in the process of further strengthening the supervisor training through 
the Cornerstone Supervisory Leadership Program. 

Question: What does DHS consider to be the appropriate Supervisor/inspector ratio? 

Response: DHS does not have an established Supervisor/Inspector ratio. 

Question: How many CFATS program supervisors, including Branch Chiefs, are not 
“acting”? 

Response: The Infrastructure Security Compliance Division (1SCD) currently has 23 
supervisors on its staff. Of these, 15 are in the supervisory positions for which they were 
hired, five are holding acting positions at a higher-level within ISCD, two are on external 
details, and one is on active military duty. 
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Question: According to the Anderson/Wulf memo, “generally, introduction of a union in 
the government workplace tends to occur after the program has been fully established and 
the work unit is mature. That is not the case with the unionization of 1SCD inspectors.” 
Why did the Administration certify the union before the CFATS program was fully stood 
up?" 

Response: The decision to organize a union in the Government workplace is one for the 
union and the employees to make, not for the Government employer. Unions organize at 
any time the members deem it appropriate for employees to be represented by a labor 
organization. Such organization efforts can occur at any time either at the developmental 
stages or once a program is established and mature. The Federal Labor Relations 
Authority (FLRA) is responsible for certifying unions. Once a labor organization decides 
it wants to organize certain employees, it approaches the employees, and acquires 
signatures from a certain percentage of employees, and has the right to file a petition with 
the FLRA. 
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Question: On March 31, 201 1, you stated: “we are trying to and continuing to try to set 
up a program that is a cooperative program. I think that by and large if you talk to 
industry, they will give you a response not dissimilar to what 1 am telling you right now.” 
The Anderson Memo though suggests that industry is feeling less cooperated with - in 
fact, employee surveys suggest the top item challenging ISCD is “achieving credibility 
with the chemical industry.” 

How do you square what you testified to 1 1 months ago with that comment from the 
ISCD employee survey? 

Response: Soon after joining the Department of Homeland Security (DHS), the new 
Infrastructure Security Compliance Division (ISCD) Director solicited the views of ISCD 
staff regarding the Chemical Facility Anti-Terrorism Standards (CFATS) program and its 
implementation, to include the perceived strengths of the program and the perceived 
challenges that ISCD faces. The statement regarding “achieving credibility with the 
chemical industry” was one issue among many that at least one ISCD staff member 
raised. While each staff member is entitled to his/her opinion, and the National 
Protection and Programs Directorate (NPPD) fully supports Divisional leadership seeking 
input from staff on challenges ISCD is facing, that does not mean that all the apparent 
challenges identified during this effort were significant or necessarily even accurate. In 
this case, NPPD continues to believe that the Department's relationship with the 
regulated community is both strong and appropriate, and Under Secretary Beers stands by 
his March 31,2011, testimony asserting as much. 

Question: How many times have you met with a broad coalition of CFATS regulated 
entities to discuss improvements to SSPs or the Personnel Surety Program? 

Response: I have directly met with the chemical industry several times over the course of 
this Administration and discussed both the SSP process and the Personnel Surety 
Program. 1 have met with the American Chemistry Council three times since the fall of 
2009, with the Chemical Sector Coordinating Council and its leadership on several 
occasions, and the Oil and Natural Gas Sector Coordinating Council once in the past 
year. Additionally, NPPD’s Deputy Under Secretary, Suzanne Spaulding, has had 
separate meetings with the chemical industry, including meetings with the Chemical 
Sector Coordinating Council and the Association Fuel and Petrochemical Manufacturers 
(formerly the National Petrochemical and Refiners Association). 
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Moreover, DHS maintains a strong relationship with CFATS regulated entities because of 
the continual engagement with these facilities. 1SCD inspectors have conducted more 
than 1,000 Compliance Assistance Visits to regulated facilities as of February 27, 2012, 
and have participated in more than 3,000 informal introductory meetings with owners 
and/or operators of CFATS-regulated facilities. 

ISCD staff have presented at hundreds of security and chemical industry conferences; 
participated in a variety of other meetings of relevant security partners; established a 
Help Desk for CFATS questions that receives dozens of calls daily; put in place a 
CFATS Tip-Line for anonymous chemical security reporting; and developed and 
regularly updated a highly regarded Chemical Security website 
(www.DHS.gov/chemicalsecurity), which includes a searchable Knowledge Center, 

ISCD has also offered regular Site Security Plan (SSP) training webinars to assist high- 
risk facilities to complete their SSPs. Improving SSPs has been a central part of the 
conversation in many of these engagements. 

ISCD has pursued many avenues in order to provide feedback to the regulated population 
on their SSP submissions and to gather recommendations and lessons learned for 
improvements to the SSP tool. This includes the previously mentioned conferences and 
outreach visits, many of which were to discuss the development of SSPs with broad 
coalitions of the regulated community through meetings with or organized by industry 
associations, such as the American Chemistry Council and the Society of Chemical 
Manufacturers & Affiliates. ISCD also has participated in the annual Chemical Security 
Summit and quarterly Chemical Sector Coordinating Council meetings, during which the 
topic of SSP submissions has been discussed. ISCD also performed 180 Preliminary 
Authorization Inspections (now referred to as Compliance Assistance Visits) to assist 
facilities in the completion of their specific SSPs, developed an SSP Helpful Hints 
document in coordination with the regulated community to share on ISCD’s website, and 
conducted weekly webinars with the regulated community in order to provide guidance 
on the completion of SSPs. 

With respect to ISCD’s engagement with industry about the CFATS Personnel Surety 
Program, DHS has attempted to leverage and build upon the existing positive relationship 
in several ways: 

• DHS staff and leadership have participated in many CFATS Personnel Surety 
Program discussions, meetings, and listening sessions with industry leaders and 
other industry stakeholders. DHS has met with industry representatives, both 
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individually and collectively, multiple times to discuss their concerns, objections, 
and ideas for alternative solutions. 

• DHS has also discussed screening and CFATS Personnel Surety Program issues 
with owners and operators on-site at chemical facilities. 

• DHS has provided annual briefings on the topic at the Chemical Sector Security 
Summit held each year in Baltimore, Maryland. 

• In August 2010, DHS conducted two workshops for private sector representatives 
in Houston, Texas to demonstrate the CFATS Personnel Surety Program data 
collection and submission process and procedures, through a question-and-answer 
session. 

The Department intends to maintain positive relations with the high-risk chemical 
facilities that it regulates, and remains attentive to any legitimate concerns that industry 
may have regarding the SSP review process and the development of the CFATS 
Personnel Surety Program. 

Question: Are policies that restrict Executive Branch work with the business community 
being employed by DHS? If so, has that inhibited communication or slowed 1SCD 
understanding of the facilities it is supposed to regulate? 

Response: DHS has followed all applicable statutory and regulatory requirements and 
Executive Branch policies concerning appropriate engagement between government 
regulators and the regulated community. DHS does not believe that adherence to these 
statutes, regulations, and Executive Branch policies has inhibited or slowed DHS’s ability 
to communicate effectively with the facilities regulated under CFATS. 
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Question: The Anderson/Wulf Memo indicates that DHS uses too many contractors and 
needs to build more expertise “in house.” On October 1, 2009, Mr. Green, asked Mr. 
Beers how many of the 1 30 people DHS was in the process of hiring or had hired were 
“experts in the field of chemical engineering, chemical process, safety, design and 
engineering.” Sue Armstrong responded that “five or six” were either civil, physical, or 
chemical engineers and one chemist was one staff. 

Has DHS put a greater emphasis on hiring in these areas to help 1SCD digest and 
interpret the Site Security Plans? 

Response: Yes. ensuring that the Infrastructure Security Compliance Division (1SCD) 
continues to have the expertise necessary to conduct Site Security Plan (SSP) reviews is a 
high priority. Currently, ISCD employs people with expertise in the following areas for 
SSP review : chemical security, cybersecurity, physical security, chemical engineering, 
chemistry, and information technology management. 

ISCD is in the process of conducting a top-to-bottom review of the Division’s staffing to 
develop a Human Resources Plan that will further define and document the roles, 
responsibilities, required skills, and reporting relationships of its staff. This plan will 
further assist ISCD in identifying any remaining human resource needs and in its future 
hiring decisions. 
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Question: It is clear CFATS is having many problems related to its IT infrastructure. 
How much money has CFATS has spent on in this area? 

Response: The Infrastructure Security Compliance Division (ISC'D) is in the process of 
further developing its information technology (IT) capabilities. As part of this process, 
ISCD is continually evaluating and enhancing its IT systems. These enhancements have 
been identified and planned for as the program has developed in order to increase ISCD's 
ability to carry out its mission, including its inspections and enforcement activities. 

ISCD has spent approximately $66.9 million from the fourth quarter of fiscal year (FY) 
2006 through January 2012 (Project Life Cycle) on its IT investments. 

Question: Of that amount, how much is being used on equipment whose direct impact on 
the CFATS program is beneficial and cost-effective? 

Response: ISCD believes that all funds expended on its IT Investments have been 
beneficial and cost-effective to the program. With regard to IT equipment specifically, 
including operational hardware and software licensing fees, ISCD has spent 
approximately $9.6 million from the fourth quarter of FY 2006 through January 2012 
(Project Life Cycle). The remaining $57.3 million of IT investment supported 
application development, hosting operations and maintenance costs, and other operations 
support for the development, maintenance, and enhancement of the IT systems. 

Question: How much will it cost to modify the CHEMS database? How long will it 
take? 

Response: Through fiscal year 2013, ISCD estimates that it will cost approximately $6 
million to make enhancements to its IT systems, including the CHEMS database. It is 
not possible to specify when enhancements and modifications to the CHEMS database 
will be completed since, in order to fulfill its mission, ISCD will continually evaluate its 
IT capabilities and identify areas of improvement, making enhancements and 
modifications as necessary. 
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Question: How much has the CFATS program spent on training-related contracts? 

Response: The infrastructure Security Compliance Division (1SCD) has spent 
approximately $7.8 million on training-related contracts for the Chemical Facility Anti- 
Terrorism Standards (CFATS) program from fiscal year (FY) 2008 to the present. 

Question: How much more will CFATS need to spend to get a training program you 
think will be useful? 

Response: ISCD believes that its training program has always been a useful tool. As the 
program has developed and assumptions about the implementation of CFATS have 
evolved, so have the needs of ISCD’s training program. At this time, the ISCD is in the 
process of evaluating and updating its training program in order to supplement previous 
curricula and further prepare its Chemical Security Inspector cadre to conduct 
inspections. ISCD estimates that it will need to spend approximately $2.5 million ($1.3 
million for travel and per diem and $1.2 million for development and trainer costs) 
through FY 2013. 

Question: How much do you think the CFATS program could save from contracting 
reforms? 

Response: At this time, ISCD cannot predict potential cost savings from contracting 
reforms. ISCD does believe that there are potential savings through changes in 
acquisition and procurement processes and planning. 
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Question: The Internal Memo mentioned that the law authorizing CFATS required 
development and implementation of the CFATS program at an “impractical” pace. 

Isn’t it true that DHS had a white paper outlining the direction of CFATS, which became 
the precursor for the CFATS interim final regulation? If so, why did the workload come 
as a surprise to DHS? 

Response: The Department of Homeland Security (DHS) was aware that developing the 
Chemical Facility Anti-Terrorism Standards (CFATS) regulatory program would be a 
significant undertaking and the scope of the effort and workload involved was not a 
surprise to the Department. Prior to receiving statutory authority to adopt regulations for 
security at high-risk chemical facilities, the Department had developed some initial 
thoughts as to what a regulatory program governing security at high-risk chemical 
facilities might involve. 

The statutory requirement set an extremely ambitious and demanding goal for the 
Department to develop such regulations within a six-month rulemaking period, while 
simultaneously hiring staff, building the program office, and establishing the processes 
and toots necessary to evaluate and potentially regulate thousands of facilities from 
across the country. The Department was successful in meeting this goal. 
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Question: How many people, whose skills were “inappropriate” for the position, were 
hired by DHS for CFATS before the CFATS program had established specific needs? 

Response: The establishment of specific program needs and the development of the long- 
term process for fulfilling identified program requirements is an ongoing and dynamic 
one. As the Chemical Facility Anti-Terrorism Standards program continues to mature, 
the Infrastructure Security Compliance Division will ensure that all of the positions it 
needs are staffed with individuals who possess the appropriate knowledge, skills, and 
abilities necessary to perform at the appropriate level. 
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Question: Compliance inspections are the final type of inspection DHS does to assure 
final compliance with the law. When do you intend to have a defined program in place to 
impart the processes and procedures necessary to conduct these inspections? Will you 
have a timeline for beginning these inspections? 

Response: Compliance inspections will be used by the Infrastructure Security 
Compliance Division (ISCD) to verify that facilities with approved Site Security Plans 
(SSP) or Alternative Security Programs (ASP) are complying with their approved SSPs 
or ASPs on a periodic and as-needed basis. 

ISCD stood up a working group in September 20 1 1 to review the current processes, 
procedures, and equipment used by ISCD’s inspectors and to update/develop additional 
materials and tools for the inspectors to accomplish all types of Chemical Facility Anti- 
Terrorism Standards inspections, including authorization inspections which occur before 
approval of an SSP. 

Based on the work of this group, ISCD plans to finalize updates to the internal inspection 
procedures later in fiscal year (FY) 2012. ISCD also plans to provide additional training 
to its inspectors, enabling them to continue authorization inspections at Tier 1 facilities in 
FY 2012. After completion of the authorization inspections for Tier 1 facilities are 
completed, ISCD will adjudicate the inspection results before final approvals may be 
issued for the Tier 1 SSPs. 

Compliance inspections will occur on a prioritized basis after facilities have been issued 
Letters of Approval. Since this depends on the findings of the authorization inspections 
and ISCD's further review of the SSPs prior to approval, ISCD is not currently able to 
provide a definite timeframe for the start of compliance inspections. 
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Question: Recently, Lawrence Stanton, Director of EPA’s Office of Emergency 
Management announced that EPA would publish non-Offsite Consequence Data on the 
EPA website. This non-OCA information includes specific facility-by-facility lists of 
covered chemicals used, the inventory of those chemicals used, preventative measures in 
place, and the location in a plant where those chemicals are used. This information 
constitutes a virtual roadmap for terrorists. Meanwhile, Greenpeace recently announced 
that it is launching a new Google mapping tool that allows anyone to see “vulnerability 
zones” 

Were you consulted on this policy change by EPA? 

Response: On October 14, 201 1, the Director of the Environmental Protection Agency’s 
(EPA) Office of Emergency Management sent an e-mail notifying, and soliciting 
feedback from, the Department of Homeland Security (DHS) about EPA's proposal to 
reestablish internet access to the non-Off-site Consequence Analysis (OCA) sections of 
the Risk Management Plan (RMP) database beginning in July 2012. EPA also briefed 
DHS and other Federal partners on the proposal during the Chemical Government 
Coordinating Council (GCC) meeting on December 8, 201 1 . 

Question: Was it subject to interagency review? 

Response: During the Chemical GCC meeting on December 8, 201 1 , EPA led an 
interagency discussion with representatives from DHS, the Department of Commerce, 
and the U.S. Chemical Safety Board on EPA’s proposal to re-post non-OCA information 
on EPA’s RMP website. 

EPA notified DHS on March 28, 2012, of EPA’s intent to extend its discussion with 
interested parties and postpone the target date for implanting the proposal indefinitely. 
DHS is in the process of developing its position on EPA’s planned action and intends to 
provide feedback and recommendations to EPA in the near future. DHS anticipates 
accepting EPA’s offer to engage in additional dialogue on this topic. 

Question: Did you or Secretary Napolitano contact the White House about it? 

Response: The National Protection and Programs Directorate’s (NPPD) Office of 
Infrastructure Protection (IP) did not contact the White House regarding EPA's proposal 
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to publish non-OCA data on the EPA website. NPPD/IP is not aware of Secretary 
Napolitano having any contact with the White House on this issue. 
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Question: What criteria are being used to prioritize the processing of site security plans? 

Are Tier 1 and Tier 2 facilities being prioritized? If not, why not? 

Response: Site Security Plans (SSP) are prioritized for processing and review according 
to the covered facilities’ risk tier levels. SSPs for the highest of the high-risk facilities, 
the Tier 1 facilities, are reviewed first, followed by review of the Tier 2, 3, and 4 
facilities, in that order. The Infrastructure Security Compliance Division (ISCD) has 
reviewed or is actively reviewing all of the SSPs for the Tier 1 facilities and has begun 
reviewing the SSPs for the Tier 2 facilities. 
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Question: The November 201 1 internal report identified several issues in the CFATS 
program related to contracting, including the use of contractors to perform core functions 
of the program. It also references a mis-tiering incident, referred to by the Department as 
the FI issue. 

My understanding is that the creation, testing, and running of the “risk engine” used to 
tier facilities was carried out by contractors, not Department personnel. Is that correct? 

Will the terms of the contracts for creation, testing and running of the risk engine be 
included in the Department’s contracting review? 

Does the Department view the running of this risk engine and the tiering of facilities to be 
core governmental functions? 

Have other core government functions been delegated to contractors? If so. please 
identify those functions. 

Please explain what steps will be taken to ensure that core governmental functions are not 
outsourced to contractors in the future. 

Response: To avoid confusion, it should be noted that the references to “core functions” 
in the internal memorandum were not intended to refer to inherently governmental 
functions. Rather, the memorandum was intended to refer to functions (e.g., training, 
technical writing) that the Infrastructure Security Compliance Division (ISCD) Director 
and Deputy Director believe should be transitioned to primarily Federal employees to 
ensure long-term stability and continuity within the Chemical Facility Anti-Terrorism 
Standards (CFATS) program. ISCD necessarily relied a great deal on support by 
contractors with Federal employee oversight when it was stood up. As ISCD and the 
CFATS program have matured, it is appropriate to transition certain functions to the 
Federal workforce to ensure that necessary skills and knowledge are not lost over time, 
especially as contracts expire, are modified or are re-competed. All contracts are and will 
continue to be evaluated using the Department of Homeland Security (DHS) Balanced 
Workforce Strategy to ensure the appropriate mix of Federal and contractor skills, 
expertise, experience, and other assets necessary to effectively achieve the mission. 
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The computer program (the so-called “risk engine”) used by DHS to help evaluate 
chemical facilities’ Security Vulnerability Assessments (SVA) was developed under the 
supervision of DHS employees by the Argonne National Laboratory. Testing was 
performed by Argonne National Laboratory, Oak Ridge National Laboratory (ORNL), 
and ABS Consulting, all under contract to DHS and subject to oversight by DHS 
employees. Physical operation of the engine occurs in a classified environment at ORNL 
and by ORNL employees under contract to DHS and with oversight by DHS federal 
employees. Risk engine results are subject to review by DHS federal employees and 
DHS issues all final high-risk determinations for individual facilities. 
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Question: In May 2010, the contractors in question notified staff within the 
Infrastructure Security Compliance Division (“ISCD”) of the FI issue and worked to 
resolve problems with the tiering analysis. At that time, ISCD leadership took several 
steps in response, including temporarily halting tiering activities. When tiering was 
begun again at the end of that month, ISCD leadership decided that tier levels should not 
be revised for facilities assigned to inappropriate tiers because of the FI issue. 

In February 201 1, when new ISCD leadership became aware of the FI issue, additional 
response actions were initiated. On June 1 , 20 1 1 , the matter was elevated out of ISCD. 
By June 27, 2011, all facilities that had been placed in inappropriate tiers had been 
informed of the issue, as had Congressional staff. 

The Department’s personnel surety program has attracted considerable attention, but has 
not been the subject of a focused hearing. While questions and testimony have focused 
on the potential to use TW1C cards to satisfy background check requirements under 
CFATS, there are additional components to personnel surety that have not been explored. 

What does the personnel surety CFATS performance standard require, and what is the 
status of any regulations and/or guidance the Department plans to provide to facilities 
working to meet that standard? 

In the Department’s view, is there security value in recurrent vetting against the Terrorist 
Screening Database or in requirements to submit identifying information about 
individuals granted access to restricted areas? 

Response: As required by the Chemical Facility Anti-Terrorism Standards (CFATS) 
regulation, each final high-risk facility must develop and submit for Department of 
Homeland Security (DUS) approval a Site Security Plan (SSP) or Alternative Security 
Program (ASP) that satisfies all of the applicable risk -based performance standards 
(RBPS) specified in CFATS. RBPS-12 requires that each SSP or ASP include 
performance of appropriate background checks on facility personnel and, as appropriate, 
unescorted visitors who have, or are seeking, access to restricted areas or critical assets at 
the facility. DHS refers to individuals requiring background checks under RBPS-12 as 
“affected individuals.” These background checks must include: 
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(i) Measures designed to verify and validate identity; 

(ii) Measures designed to check criminal history; 

(iii) Measures designed to verify and validate legal authorization to work; and 

(iv) Measures designed to identify people with terrorist ties. 

The Department issued guidance for all of the RBPS in May 2009 

(http://www.dhs.gov/xlibrary/assets/chemsec_cfats_riskbased_performance_standards.pd 
f). The RBPS Guidance document discusses each RBPS, and provides examples of 
security measures that covered facilities may wish to consider when developing their 
SSPs or ASPs. For RBPS- 12, the RBPS Guidance states that, in relation to the four types 
of background checks that must be conducted, facilities may want to explain in their 
SSPs how these background checks will be conducted, what the contents of the checks 
will include, and how frequently the facility will audit its background check program. 

With respect to the requirement that covered facilities perform background checks 
designed to identify people with terrorist ties, the Department recognized at the time that 
the CFATS regulation was adopted that DHS would need to play a large role in that 
process, since private facilities do not have access to government databases that can be 
used to screen for terrorist ties. Accordingly, DHS has been developing a Personnel 
Surety Program, under which covered facilities (or third party submitters authorized to 
act on behalf of the covered facilities) would submit to the Department biographic 
information about affected individuals. The Department would then leverage an existing 
capability within the Department to vet this information against records in the Terrorist 
Screening Database (TSDB). The Department is exploring ways to minimize redundant 
background checks on individuals who have already undergone a DHS security threat 
assessment that checks individuals for terrorist ties as part of the Transportation Worker 
Identification Credential (TW1C) program, the Hazardous Material Endorsement (FIME) 
program, or Trusted Traveler Programs. 

DHS believes that though the implementation of the Personnel Surety Program, and 
recurrently vetting information pertaining to affected individuals against the TSDB, will 
add security value to CFATS and to individual high-risk chemical facilities’ SSPs. As a 
result of implementing the Personnel Surety Program, DHS expects to be in a better 
position to identify any known or suspected terrorists with access to sensitive areas of 
high-risk chemical facilities. 

The Department is in the process of complying with additional legal requirements before 
implementing the Personnel Surety Program, including the requirements of the 
Paperwork Reduction Act (PRA). As part of DHS’s obligations under the PRA, the 
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Department twice solicited comments through the Federal Register regarding DHS’s 
proposed Information Collection Request (ICR), including the burden associated with the 
proposed collection and submitted an Information Collection Request (ICR) to the Office 
( of Management and Budget (OMB) for review and approval. 1 The precise ways in which 
high-risk chemical facilities will be able to participate in the Personnel Surety Program to 
satisfy the terrorist-ties screening requirement of RBPS-12 is still being determined. 

Before implementing the Personnel Surety Program, the Department must also ensure 
that appropriate controls are in place and comply with the Privacy Act, the E-Government 
Act, and DHS policy. Accordingly, the Department has published a Privacy Impact 
Assessment (DHS/NPPD/PIA-01 8 Chemical Facilities and Anti-Terrorism Standards 
Personnel Surety, May 4, 201 1) and a System of Records Notice (DHS/NPPD-002 - 
Chemical Facility Anti-Terrorism Standards Personnel Surety Program System of 
Records, June 14, 201 1, 76 FR 34732) for the program. The Department also published a 
notice of proposed rulemaking to exempt portions of the CFATS Personnel Surety 
Program System of Records from specific provisions of the Privacy Act in order to 
protect information relating to national security, law enforcement, and intelligence 
activities from disclosure to the public. See 76 FR 34616 (June 14, 2011). Prior to 
implementation of the CFATS Personnel Surety Program, the Department may publish a 
final rule for Privacy Act exemptions. 

In addition to the Department’s efforts to ensure that there is a mechanism available for 
people with terrorist ties to be identified at high-risk chemical facilities, facilities are 
responsible for including measures in their SSPs or ASPs to perform the other types of 
background checks required under RBPS-12. The Department will evaluate each SSP 
and ASP to determine whether these measures meet the applicable performance standard. 
The CFATS Personnel Surety Program is not intended to halt, hinder, or replace these 
three other types of background checks. 


1 The Department published three notices in the Federal Register regarding this ICR. The first notice 
announced the initial 60-day period for the public to review and provide comment at 74 FR 27555 (June 1 0, 
2009). 60-second notice published the comments submitted by the public during the initial 60-day period 
and announced an additional 30-day period 60-public comment at 75 FR 1 8850 (April 1 3, 20 1 0). The third 
notice published the Department’s responses to comments received during the 30-day comment period at 
76 FR 34720 (June 14.2011). 
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Question: The action plan accompanying the November 201 1 internal report calls for a 
working group to develop recommendations for needed statutory and regulatory changes. 

When is the Department’s timeline for developing and communicating those 
recommendations? 

Response: An internal Infrastructure Security Compliance Division (ISCD) Working 
Group has completed the initial identification of a variety of potential policy and process 
modifications that it believes should be considered to improve the Chemical Facility 
Anti-Terrorism Standards program's ability to efficiently achieve its mission. Many of 
these potential improvements could be accomplished through policy changes or process 
modifications, while others likely would require additional rulemaking. The Working 
Group looking into these issues is in the process of finalizing its recommendations for 
addressing these issues and is scheduled to brief the ISC D Director on those 
recommendations in the coming weeks. At that point. National Protection and Programs 
Directorate leadership will be briefed on the recommendations. The Department of 
Homeland Security intends to engage with the appropriate Congressional oversight 
committees upon review and final approval of the recommendations. 
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Question: How can strengthening whistleblower protections improve the ability of DHS 
to implement an effective CFATS program? 

How can we ensure whistleblowers have access to enough information to identify 
security concerns which may have been overlooked? 

How can we ensure that information shared by whistleblowers about overlooked safety 
concerns is passed up the chain to the correct people? 

How can we reform CFATS to best encourage whistleblowers to come forward with their 
security concerns? 

Response: The Department of Flomeland Security (DHS) does not perceive a need at this 
time to include additional whistleblower protections to encourage Departmental 
employees to come forward with any security concerns they may have over 
implementation of the Chemical Facility Anti-Terrorism Standards (CFATS). While 
there are no specific whistleblower protections under Section 550 of the Homeland 
Security Appropriations Act for Fiscal Year 2007 or the CFATS regulation, Section 883 
of the Homeland Security Act of 2002 (Pub. L. No. 107-296) specifically states that the 
whistleblower protections for employees of the Department under sections 2302(b)(8) 
and (9) of title 5, United States Code and the Notification and Federal Employee Anti- 
discrimination and Retaliation Act of 2002 (Pub. L.No. 107-174) (NOFEAR Act) apply 
to Departmental employees, including those responsible for developing and administering 
the CFATS program. 

In addition to these statutory protections against retaliation, each Infrastructure Security 
Compliance Division (1SCD) employee has been advised of his or her responsibility to 
share with leadership any pertinent programmatic information or concerns. A number of 
methods have been identified to facilitate the sharing of this information, including ISCD 
director-led town halls and the use of an open-door policy. The open-door policy makes 
clear that if any ISCD employee is not satisfied with how an apparent security issue is 
being addressed, he/she can raise their concern with leadership of the National Protection 
and Programs Directorate (NPPD), the Office of Infrastructure Protection, or 1SC.D. 

ISCD believes this policy is an effective means to encourage employees to share their 
concerns and to ensure that leadership will be aware of pertinent programmatic 
information and will be in a position to address any significant concern in an appropriate 
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fashion. Additionally, the Under Secretary of NPPD has noted in different meetings and 
forums that it is everybody’s responsibility to share information with their leadership, 
especially information that can be used to identify areas where we need to improve our 
programs’ level of performance. 

ISCD also operates the CFATS Tipline, which allows for the reporting of potential 
security concerns involving the CFATS regulation. Callers can anonymously report 
concerns via voicemail or leave their name and number if a return call is desired at 1-800- 
FYI-4DHS (800-394-4347). The Tipline is available not only to DHS employees but also 
to facility employees and the general public. Once D1TS receives a Tipline call, it is 
entered into a software management system for record-keeping purposes and then 
forwarded to ISCD’s Compliance Section. It then assigns a Regional Compliance Case 
Manager to the matter to serve as the point person for coordinating ISCD's efforts to 
ascertain whether the caller has credibly identified a credible security issue that needs to 
be addressed. If it is determined that a credible security issue has been identified. ISCD 
will take appropriate steps to ensure that the security issue is being properly addressed. 
Any calls deemed threatening or suspicious arc immediately forwarded to the attention of 
ISCD leadership and/or appropriate Federal, state, or local law enforcement agencies. 
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Question: How can Congress best support the efforts of DHS to continue outreach at the 
state and local level? 

Response: Congress can best support the Department of Homeland Security’s (DHS) 
outreach efforts by establishing a permanent authority for the Chemical Facility Anti- 
Terrorism Standards (CFATS) program in Federal law and by continuing to fund CFATS 
at appropriate levels consistent with the President’s annual budget requests. Permanent 
authorization would communicate to state and local partners that this important security 
program is here to stay, thereby justifying their time spent in facilitating outreach 
activities and ongoing long-term collaboration with the Department. 

Question: How can CFATS regulatory framework be reformed to improve the ability of 
DHS to hire qualified personnel? 

Response: We do not believe the current CFATS regulatory framework in any way 
inhibits the ability of DHS to hire qualified personnel. 

Question: Are there currently any regulatory barriers that prevent optimal coordination 
with state and local authorities? 

Response: We do not believe the current CFATS regulatory framework prevents DHS 
from coordinating effectively with state and local authorities. 

Question: How has feedback from the public and private sector partners changed the 
program’s implementation activities? 

Response: Since the enactment of Section 550 of the DHS Appropriations Act for Fiscal 
Year 2007, public and private sector feedback has helped shape and improve 
implementation of the CFATS program. The Department’s willingness to solicit and 
consider input from public and private security stakeholders began at the program’s 
inception when, during the accelerated six-month period mandated by Section 550 for 
adoption of interim final rules, the Department issued an Advanced Notice of Public 
Rulemaking (ANPRM) soliciting public input on many issues that ultimately were 
addressed in the CFATS interim final rule that was issued in April 2007. Similarly, DHS 
solicited public comments on a proposed Appendix A to CFATS in the interim final 
rulemaking notice, and those comments helped DHS develop the final Appendix A, 
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issued in November 2007, which listed more than 300 chemicals of interest and 
associated screening threshold quantities that facilities use to determine if they must file 
Top-Screens under CFATS. 

With regard to implementation of the final regulations, DHS has sought and reacted to 
feedback from the regulated community and our public sector partners in a variety of 
ways, consistent with the regulatory nature of the CFATS program. For example, the 
Department has had members of industry test prototypes of various applications in the 
Chemical Security Assessment Tool currently used by the regulated community to 
comply with CFATS. In addition, DHS invited and responded to public comments in the 
development of the Risk-Based Performance Standards Guidance document and has 
sought feedback from the regulated community on informational materials, such as the 
Site Security Plan Helpful Hints fact sheet. We believe that private sector input has been, 
and continues to be, extremely valuable, and we look forward to continuing to receive 
feedback from them and to using it to continually improve CFATS implementation. 

Question: The CFATS program was established without regulatory input from the 
majority of Congress. Do you believe the incorrect tiering of 600 facilities in 201 1 serves 
as an example that we need to reform this statute? 

Response: No, we do not believe that this incident warrants statutory reform of the 
CFATS program. In 2010, the use of certain incorrect data in one computer program that 
helps identify high-risk chemical facilities resulted in certain facilities potentially 
receiving risk-based tier assignments higher than they otherwise might. DHS 
immediately corrected the data error when the problem was discovered in mid-2010. In 
mid-201 1, DHS decided to review all 501 tiering decisions potentially affected by that 
computer data error. Of the 501 facilities, 35 facilities had already been determined to no 
longer be high risk prior to the re-evaluation process, for reasons unrelated to the tiering 
issue. Upon further review of the remaining 466 facilities, DHS determined that 99 
facilities were no longer considered high-risk; 148 facilities’ overall tier levels should be 
lowered; 1 78 facilities should retain their facility tier levels, although other aspects of 
their final tier determinations should be revised; and that 41 facilities were pending SVA 
review or redetermination. DHS notified all of the potentially affected facilities of the 
results of this review in June 2011. 

However, the Department does believe that certain reforms could be made to the statutory 
authority to make the program more effective and to better secure the Nation. An 
example is the granting of permanent (or at least long-term) authorization. 
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Question: The November 201 i internal report highlighted difficulties the Department 
faces in the review of Site Security Plans. The process of evaluating these plans to 
ensure that security standards will be met is an essential step in the successful execution 
of the CFATS program, and is essential to our national security. 

Please explain the challenges the Department faces with evaluating these plans. 
Specifically, please explain why it is necessary to adopt an interim process while a long- 
term process is developed. 

If the Department’s process will change between the interim approval process and the 
long-term process, please explain how the Department will assure the dual goals of 
providing facilities with some certainty about their compliance and providing the public 
with the certainty of adequately safeguarded facilities. 

Response: The primary challenges the Department of Homeland Security (DHS) faces in 
evaluating Site Security Plans (SSP) are related to the following: 

a) the nature of the Chemical Facility Anti-Terrorism Standards (CFATS) 
regulation, which allows covered facilities a substantial amount of flexibility to 
include tailored, site-specific security measures commensurate with each facility’s 
individual risk and circumstances; and 

b) the inadequate level of detail initially provided by some facilities in their SSPs, 
which complicates the Department’s ability to determine whether the security 
measures contained in the SSPs satisfy the risk-based performance standards 
approach mandated by the CFATS regulation and its underlying statutory 
authority. 

In February 2010, the Infrastructure Security Compliance Division (1SCD) began 
conducting what was then referred to as preliminary authorization inspections (now 
referred to as compliance assistance visits) of final-tiered facilities, starting with the Tier 
I facilities, and has completed approximately 180 such visits to date. ISCD used these 
visits to help gain a comprehensive understanding of the processes, risks, vulnerabilities, 
response capabilities, security measures and practices, and other factors at a covered 
facility that affect security risk and to help facilities more fully develop and explain the 
security measures in their SSPs. This action assisted the Department in ensuring that 
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facilities included the appropriate level of detail in their SSPs to enable 1SCD to conduct 
a complete review. 

Additionally, 1SCD has established an interim SSP review process that includes the 
development and refinement of, and training on, definitions and review procedures; a 
multi-layered review' approach that still allows for expeditious review and that ensures 
consistency in application of standards; and a quality assurance role to review and report 
on the effectiveness, efficiency, and consistency of reviews. 

1SCD is in the process of further refining the long-term review process and will 
incorporate lessons learned from the interim review process. 
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Question: At last year’s markup of CFATS legislation, I sought to clarify an ambiguity 
in the SSP review process. The current language in section 550 governing this issue 
states “the Secretary may disapprove a site security plan if the plan fails to satisfy the 
risk-based performance standards established by this section.” This language appears to 
grant discretion to the Secretary to approve site security plans that fail to meet, the risk- 
based performance standards under this program. Changes to section 550 could create 
greater clarity in the Site Security Plan review process, and provide greater certainty for 
regulated entities and the citizens living near them. At the hearing, we learned that the 
Department would prefer to never disapprove a plan, instead, the Department would 
prefer to work with facilities to improve any deficiencies in submitted plans, to ultimately 
develop approvable plans. 

Should the Department have the discretion to approve a site security plan that fails to 
meet the risk-based performance standards of the CFATS program? 

Would the Department support replacing the words “may disapprove” in section 550 with 
“shall not approve”? This would preserve the Department’s ability to work with 
regulated facilities towards site security plans that meet the risk-based performance 
standards while clarifying that inadequate plans may not be approved. 

Response: No such statutory revision is necessary. The statute (Section 550 of the 
Department of Homeland Security [DHS] Appropriations Act for Fiscal Year 2007) and 
the Chemical Facility Anti-Terrorism Standards (CFATS) regulation already provide the 
Department with the flexibility to work with covered facilities to ensure the adequacy of 
the security measures described in their Site Security Plans (SSP) (or Alternative Security 
Programs) prior to approving any SSP, while also authorizing the Department to 
disapprove any SSP that does not meet applicable Risk-Based Performance Standards 
(RBPS). Section 27.245(a) of the CF ATS regulation contains spec ific procedures for 
approval of SSPs that satisfy the RBPS and other CFATS requirements (as specified in 
Section 27.225 of the regulations). Section 27,245also provides procedures for 
disapproving any SSP that the Department ultimately determines is deficient because it 
does not satisfy the requirements of Section 27,225 (including failure to meet the 
applicable RBPS). The Department does not interpret either Section 550 or Section 
27.245 as requiring DHS to approve an SSP that fails to meet the applicable RBPS. 
Accordingly, DHS does not believe that it is necessary to replace “may disapprove” with 
“shall not approve” in Section 550. 
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